Attack Chains are possible threats inferred based on correlating events tagged across all connected topics. Correlation is done by agentic AI with Apache Flink Agents around the Active Threats items pulled from the SOC Prime Platform.
Attack Chains are formed through a 3-tier correlation process:
Tier 1 – Incoming events are evaluated against Sigma rules and matching events are tagged with labels identifying the rule, MITRE ATT&CK techniques, and relevant context. This step standardizes and prepares events for correlation without determining whether they represent an incident on their own.
Tier 2 – Tagged events are evaluated against Higher Order Sigma rules which describe multi-event patterns that represent potential attack sequences in the defined time window, that are related to the same host. When a sufficient portion of a defined sequence is matched, an Attack Chain is formed.
Tier 3 – Attack Chains are further processed by a Flink agent in combination with an LLM. The agent enriches the Attack Chain with contextual data, analyzes the sequence of events, and classifies the chain as a confirmed detection or likely false positive.
Configure Attack Chain Correlation
Attack Chain correlation is configured through Chaining Pipelines. A Chaining Pipeline defines the destination topics to monitor and the parameters used to correlate tagged events and form Attack Chains.
To configure Attack Chain formation, go to Pipelines → Correlation and select New Chaining Pipeline.
For more information, see this guide.
Attack Chains Overview
The top of the Attack Chains page shows overall statistics on the inferred threats:
Attack Chains – Total number of attack chains built
Monitored Threats – Total number of Active Threats items that are currently used for correlation
Affected Hostnames – Total number of unique hosts related to the correlated events
Tagged Events – Total number of tagged events that were correlated
Matched Rules – Total number of detection rules associated with Active Threats items and used for the correlation of tagged events
The page consists of two tabs – Attack Chains and Monitored Threats.
Attack Chains Tab
The Attack Chains tab includes a list of Attack Chains with the following details on each item:
Severity – Severity of the Attack Chain (according to the corresponding Active Threats item)
Name – Name of the Attack Chain (according to the corresponding Active Threats item)
Pipeline – The Chaining Pipelines where this Attack Chain has been formed. Click a pipeline name to open its details and edit the pipeline if needed
Hostname – Host primarily associated with the detected activity
Username – User primarily associated with the detected activity
Match – Percentage of sequences from Higher Order Sigma rule that match correlated events
Tagged Events – Total number of tagged events that were used for correlation
Matched Rules – Total number of detection rules that were used for correlation
First/Last Seen – Timestamp of the first and last correlated event included in the Attack Chain
Status – Investigation Status of the Attack Chain. Manage it on the Attack Chain details page.
By default, the Attack Chains list is sorted by Last Seen, with the most recent chains displayed first.
Use the search bar to search Attack Chains by name, hostname, username, or MITRE ATT&CK technique ID.
Use the available controls to filter the visibility of Attack Chains:
Show Filtered Out – This button toggles the visibility of Attack Chains that the AI Agentic flow marked as false positives or low priority. By default, these chains are hidden to keep the view focused on high‑priority detections. Click to show or hide the filtered chains as needed
All Chaining Pipelines – Filter Attack Chains by all Chaining Pipelines or by an individual pipeline
Group by – Group the Attack Chains by Hostname or Chain Name
All Severities – Filter Attack Chains by severity level
All Statuses – Filter Attack Chains by investigation status
Click the Attack Chain name or its eye icon to view details.
Attack Chain Details
Use this page as the starting point for the investigation of the detected Attack Chain. To manage the lifecycle of the Attack Chain, change its Status, which has the following values:
New
Investigating
Confirmed
False Positive
Resolved
Closed
Filtered Out – Attack Chains that the AI Agentic flow marked as false positives or low priority
General
This tab displays information about the Attack Chain that is generated after it is processed by the Flink agent and enriched with contextual data using an LLM.
Key details:
Severity – According to the Associated Active Threat item
Hostname – Primary host associated with the detected activity
Username – Primary user associated with the detected activity
Tagged Events – Total number of events used for correlation
Matched Rules – Total number of rules used for correlation
View in SIEM – This button enables you to query all related events in your SIEM to investigate this Attack Chain in depth
Note: To use this feature:
Configure an integration with your SIEM
Ensure that in Kafka all destination topics that contain tagged events are connected to your SIEM
AI Summary – Provides a contextual overview of the detected activity
Monitored Threat – Shows the associated Active Threat item, including its type and release date. Click the Monitored Threat tile to view key information from the Active Threat item
Tags:
Techniques and sub-techniques – MITRE ATT&CK techniques used by adversaries in this threat context
Threat Actors – threat actors related to the threat
First Seen – Timestamp of the first correlated event included in the Attack Chain
Last Seen – Timestamp of the last correlated event included in the Attack Chain
Chain (techniques over time). Green items refer to detected techniques. The grey ones refer to techniques associated with the Active Threats item that have not been detected yet
List of detected techniques, where each technique has the following details:
Name and ID
Matched Rules
First Seen
Last Seen
List of rules within the detected technique. Click a rule to open its details page, where you can view and edit the rule. The list includes the following details:
Name
Severity level
Tagged Events
First Seen
Last Seen
View in SIEM. Click the button to query the events tagged by the selected rule in your SIEM.
Note: To use this feature:
Configure an integration with your SIEM
Ensure that in Kafka all destination topics containing tagged events are connected to your SIEM
Higher Order Sigma Rules
Higher Order Sigma rules are correlation rules that evaluate tagged events against multi-event patterns (sequences) to detect potential Attack Chains. Higher Order Sigma rules are based on detection rules defined in Active Threats and use the Attack Flow – a sequence of attack techniques mapped to the MITRE ATT&CK framework, to determine the sequence of adversary actions.
Click Copy to copy the Higher Order Sigma rule to the clipboard, or click Download to save it in YAML format.
Monitored Threats Tab
The Monitored Threats tab includes a list of Active Threat items included in the monitoring scope. By default, it includes Active Threats from the last 30 days, retrieved from the SOC Prime Platform.
You can control which Active Threats to include in monitoring. For this, select the checkbox next to the corresponding Active Threat/s and then click Enable or Disable button to open a dialog where you can select the Chaining Pipelines in which to enable or disable monitoring for the selected threat/s.
By default, all the Active Threats from the list are included in the monitoring scope.
If one of the Sigma rules used in Active Threat item is not supported in Prime Detect, is disabled in all the pipelines it's connected to, or is not connected to any pipeline, the Attack Chain cannot be formed. In such cases, an issue label is displayed on the Threat item. Click the label to open the Issue Navigator, which shows the issue details.
If no issues are present, a green checkmark is shown on the Threat item instead.
The Monitored Threats tab includes the following details on each item:
Severity – Severity level of the Active Threat
Name – Name of the Active Threat
Affected Industries – Industries most impacted by the Active Threat
Affected Geographies – Geographical areas most impacted by the Active Threat
Threat Type – The category of the Active Threat
Release Date – The date when the Active Threat was published
Use the search bar to search Active Threats by name or MITRE ATT&CK technique ID.
Use the available filters:
All Severities – Filter Active Threats by severity level
All Industries – Filter Active Threats by industries
All Types – Filter Active Threats by category of the threat
All Regions – Filter Active Threats by region
Click the Active Threat name to view details.
Active Threat Details
Overview
This page provides the following information:
AI Summary – High-level view of the threat context, including:
Summary – AI-generated summary with the threat’s primary characteristics
Investigation – Recommended actions for investigating the threat
Mitigation – Recommended actions for mitigating the threat according to the best security practices
Response – Recommended response actions to minimize the risks of the threat
Tags:
Techniques & Sub-techniques – MITRE ATT&CK techniques and sub-techniques associated with the threat
Threat Actors – Threat actors associated with the threat
Release Date – The date when the Active Threat was published
Affected Industries – Industries most impacted by the Active Threat
Affected Geographies – Geographical areas most impacted by the Active Threat
Threat Type – The category of the Active Threat
Running in Chaining Pipelines – Lists all Chaining Pipelines where the current threat is being monitored.
Each tile includes the following information:
Enable/Disable toggle – Enables or disables monitoring of the threat in the corresponding Chaining Pipeline
Attack Chains bar – Shows the number of Attack Chains formed for the current threat in the corresponding Chaining Pipeline. The colored segments show the breakdown of Attack Chains by status (New, Investigating, Confirmed, False Positive, Resolved, Closed). Hover over the bar to see the status name and the number of Attack Chains in that status.
First Seen – Shows when the threat was first detected in the corresponding Chaining Pipeline
Last Seen – Shows when the threat was most recently detected in the corresponding Chaining Pipeline
Use the Block for all pipelines toggle to remove the threat from monitoring in all existing Chaining Pipelines and prevent it from being monitored in any Chaining Pipelines created in the future.
Detections
The Detections tab includes the following information:
Higher Order Sigma Rules – Correlation rule related to the Active Threats item. Click the rule to open its details. On the Higher Order Sigma rule page, you can:
Copy the rule
Download the rule in YAML format
Open the rule in Prime Architect
Detections – List of detections related to the Active Threats item. Click a rule to open its details page, where you can view and edit the rule. The list includes the following details:
Rule Name. The title of the rule
Severity. Severity level of the rule
Created. The date when the rule was created
Updated. The date when the rule was updated
Repository. The Repository where the rule is located
Click the rule to open its details.On the rule page, you can:
View the rule body
Copy the rule
Download the rule in YAML format
If there is an issue with one or more Sigma rules associated with the Active Threat, an Issue Navigator label is displayed next to the Detections tab. This can occur if a rule is unsupported in Prime Detect, disabled in all Matching Pipelines it is connected to, or not connected to any Matching Pipeline. Click the label to open the Issue Navigator and view details about the issue. An Issue Navigator icon is also displayed next to each affected rule. Hover over the icon to view details.
Attack Flow
Displays a visual representation of the adversary's attack sequence of the associated Active Threats item based on the MITRE ATT&CK framework. The diagram illustrates how the attack progresses through different stages and techniques, helping you understand the overall attack path.
