Attack Chains are possible threats inferred based on correlating events tagged across all connected topics. Correlation is done by agentic AI with Apache Flink Agents around the Active Threats items pulled from the SOC Prime Platform.
Attack Chains are formed through a 3-tier correlation process:
Tier 1 – Incoming events are evaluated against Sigma rules and matching events are tagged with labels identifying the rule, MITRE ATT&CK techniques, and relevant context. This step standardizes and prepares events for correlation without determining whether they represent an incident on their own.
Tier 2 – Tagged events are evaluated against Higher Order Sigma rules which describe multi-event patterns that represent potential attack sequences in the defined time window, that are related to the same host. When a sufficient portion of a defined sequence is matched, an Attack Chain is formed.
Tier 3 – Attack Chains are further processed by a Flink agent in combination with an LLM. The agent enriches the Attack Chain with contextual data, analyzes the sequence of events, and classifies the chain as a confirmed detection or likely false positive.
The top of the Attack Chains page shows overall statistics on the inferred threats:
Attack Chains – Total number of attack chains built
Monitored Threats – Total number of Active Threats items that are currently used for correlation
Affected Hostnames – Total number of unique hosts related to the correlated events
Tagged Events – Total number of tagged events that were correlated
Matched Rules – Total number of detection rules associated with Active Threats items and used for the correlation of tagged events
The page consists of two tabs – Attack Chains and Monitored Threats.
Attack Chains Tab
The Attack Chains tab includes a list of Attack Chains with the following details on each item:
Severity – Severity of the Attack Chain (according to the corresponding Active Threats item)
Name – Name of the Attack Chain (according to the corresponding Active Threats item)
Hostname – Host primarily associated with the detected activity
Username – User primarily associated with the detected activity
Match – Percentage of sequences from Higher Order Sigma rule that match correlated events
Tagged Events – Total number of tagged events that were used for correlation
Matched Rules – Total number of detection rules that were used for correlation
First/Last Seen – Timestamp of the first and last correlated event included in the Attack Chain
Status – Investigation Status of the Attack Chain. Manage it on the Attack Chain details page.
Use the search bar to search Attack Chains by name, hostname, or username.
Use the available controls to filter the visibility of Attack Chains:
Show Filtered Out – This button toggles the visibility of Attack Chains that the AI Agentic flow marked as false positives or low priority. By default, these chains are hidden to keep the view focused on high‑priority detections. Click to show or hide the filtered chains as needed
Group by – Group the Attack Chains by Hostname or Chain Name
All Severities – Filter Attack Chains by severity level
All Statuses – Filter Attack Chains by investigation status
Click the Attack Chain name or its eye icon to view details.
Attack Chain Details
Use this page as the starting point for the investigation of the detected Attack Chain. To manage the lifecycle of the Attack Chain, change its Status, which has the following values:
New
Investigating
Confirmed
False Positive
Resolved
Closed
Filtered Out – Attack Chains that the AI Agentic flow marked as false positives or low priority
General
This tab displays information about the Attack Chain that is generated after it is processed by the Flink agent and enriched with contextual data using an LLM.
Key details:
Severity – According to the Associated Active Threat item
Hostname – Primary host associated with the detected activity
Username – Primary user associated with the detected activity
Tagged Events – Total number of events used for correlation
Matched Rules – Total number of rules used for correlation
View in SIEM – This button enables you to query all related events in your SIEM to investigate this Attack Chain in depth.
Note: To use this feature:
Configure an integration with your SIEM
Ensure that in Kafka all destination topics that contain tagged events are connected to your SIEM
AI Summary – Provides a contextual overview of the detected activity.
Tags:
Techniques and sub-techniques – MITRE ATT&CK techniques used by adversaries in this threat context
Threat Actors – threat actors related to the threat
First Seen – Timestamp of the first correlated event included in the Attack Chain
Last Seen – Timestamp of the last correlated event included in the Attack Chain
Chain (techniques over time). Green items refer to detected techniques. The grey ones refer to techniques associated with the Active Threats item that have not been detected yet
List of detected techniques, where each technique has the following details:
Name and ID
Matched Rules
First Seen
Last Seen
List of rules within the detected technique. Click the technique to open the list of rules that have the following details:
Name
Tagged Events
First Seen
Last Seen
View in SIEM. Click the button to query the events tagged by the selected rule in your SIEM.
Note: To use this feature:
Configure an integration with your SIEM
Ensure that in Kafka all destination topics containing tagged events are connected to your SIEM
Active Threat
This tab shows the core info from the associated Active Threats item, including:
Summary – AI-generated summary with the threat’s primary characteristics
Investigation – Recommended actions for investigating the threat
Mitigation – Recommended actions for mitigating the threat according to the best security practices.
Response – Recommended response actions to minimize the risks of the threat
Attack Flow – Visualization of the adversary activity of the associated Active Threats item
Detections – List of detections related to the Active Threats item. Click the rule to open its details
Higher Order Sigma Rules
Higher Order Sigma rules are correlation rules that evaluate tagged events against multi-event patterns (sequences) to detect potential Attack Chains. Higher Order Sigma rules are based on detection rules defined in Active Threats and use the Attack Flow – a sequence of attack techniques mapped to the MITRE ATT&CK framework, to determine the sequence of adversary actions.
Click Copy to copy the Higher Order Sigma rule to the clipboard, or click Download to save it in YAML format.
Monitored Threats Tab
The Monitored Threats tab includes a list of Active Threat items included in the monitoring scope. By default, it includes Active Threats from the last 30 days, retrieved from the SOC Prime Platform.
You can control which Active Threats to include in monitoring by enabling or disabling them using the toggles next to each Active Threat item, or apply bulk actions to enable or disable multiple Active Threat items at once. By default, all the Active Threats from the list are included in the monitoring scope.
If one of the Sigma rules used in Active Threat item is not supported in Detect Flow, is disabled in all the pipelines it's connected to, or is not connected to any pipeline, the Attack Chain cannot be formed. In such cases, an issue label is displayed on the Threat item. Click the label to open the Issue Navigator, which shows the issue details.
If no issues are present, a green checkmark is shown on the Threat item instead.
The Monitored Threats tab includes the following details on each item:
Severity – Severity of the Active Threat
Name – Name of the Active Threat
Affected Industries – Industries most impacted by the Active Threat
Affected Geographies – Geographical areas most impacted by the Active Threat
Threat Type – The category of the Active Threat
Release Date – The date when the Active Threat was published
Use the search bar to search Active Threats.
Use the available filters:
All Severities – Filter Active Threats by severity level
All Industries – Filter Active Threats by industries
All Types – Filter Active Threats by category of the threat
All Regions – Filter Active Threats by region
Click the Active Threat name to view details.
Active Threat Details
This page provides the following information:
AI Summary – High-level view of the threat context, including:
Summary – AI-generated summary with the threat’s primary characteristics
Investigation – Recommended actions for investigating the threat
Mitigation – Recommended actions for mitigating the threat according to the best security practices.
Response – Recommended response actions to minimize the risks of the threat
Tags:
Severity – Severity of the Active Threat
Release Date – The date when the Active Threat was published
Affected Industries – Industries most impacted by the Active Threat
Affected Geographies – Geographical areas most impacted by the Active Threat
Threat Type – The category of the Active Threat
Attack Flow – Visualization of the adversary activity of the associated Active Threats item
Higher Order Sigma Rules – Correlation rule related to the Active Threats item. Click the rule to open its details. On the Higher Order Sigma rule page, you can:
Copy the rule
Download the rule in YAML format
Open the rule in Uncoder AI
Detections – List of detections related to the Active Threats item. Click the rule to open its details. On the rule page, you can:
Copy the rule
Download the rule in YAML format
Open the rule in Uncoder AI
Edit the rule
Correlation Settings
You can configure the parameters that control how Attack Chains are formed.
On the Attack Chains page, select Configure in the upper-right corner.
Set Threshold for chain forming. It defines the minimum percentage of Higher Order Sigma rule sequences that must be matched with tagged events for a chain to be formed (e.g., if you set 50%, it means at least 3 out of 6 sequences must match with tagged events). A sequence is considered matched when any of its underlying Sigma rules are triggered.
Set Correlation window. It defines how far back in time tagged events are considered for correlation. The configurable range is from 30 seconds to 3 minutes.
Enable the Auto-add New Topics For Monitoring to automatically include newly created topics in the monitoring scope.
Include or exclude topics by toggling them on or off to control which events to use for monitoring.
Select Save.
To begin processing events and forming attack chains based on current configuration, click Run and confirm your action by clicking Start.
Tip: You can stop the process of forming Attack Chains based on your configurations by clicking Stop.