Attack Chains are possible threats inferred by correlating events from scan results in Attack Detective. Correlation is done by agentic AI around the Active Threats items by analyzing events within your Data Plane (your SIEM, EDR/XDR, or Data Lake instances) to identify potential attack patterns and sequences of adversary activity.
Attack Chains are formed through a 3-tier correlation process:
Tier 1 – Sigma rules are translated into native query languages supported by the selected Data Plane and are executed against events in the selected Data Plane during a scan. This step prepares events for correlation without determining whether they represent an incident on their own.
Tier 2 – Events from scan results that match the queries are evaluated against Higher Order Sigma rules which describe multi-event patterns that represent potential attack sequences in the defined time window, that are related to the same host. When a sufficient portion of a defined sequence is matched, an Attack Chain is formed.
Tier 3 – Attack Chains are further processed by AI agent. The agent enriches the Attack Chain with contextual data, analyzes the sequence of events, and classifies the chain as a confirmed detection or likely false positive.
Configure Attack Chain Correlation
To configure the parameters that control how Attack Chains are formed, follow the steps below:
Select Attack Chains in the header navigation of Attack Detective.
On the Attack Chains page, select Configure in the upper-right corner.
Set Threshold for chain forming. It defines the minimum percentage of Higher Order Sigma rule sequences that must be matched with events for a chain to be formed (e.g., if you set 50%, it means at least 3 out of 6 sequences must match with events). A sequence is considered matched when any of its underlying Sigma rules are triggered.
Set Correlation window. It defines the time interval within which detected events must occur to be correlated into an Attack Chain. The configurable range is from 1 hour to 24 hours.
Set Lookback window. It defines how far back in time the system searches for events when analyzing potential Attack Chains. The configurable range is from 1 day to 365 days.
Include or exclude Data Planes by toggling them on or off to control which events to use for monitoring.
Enable the Auto-add New Data Planes For Monitoring to automatically include newly created Data Planes in the monitoring scope.
Enable Data Transfer Consent to allow to transfer and store hostname data required for Attack Chain correlation. When disabled, the next correlation engine start will require you to confirm data transfer and storage consent again.
Select Save.
To begin processing events and forming attack chains based on current configuration, click Run and confirm your action by clicking Start.
Once processing starts, the button switches to a Running state and displays a timer showing how long attack chain monitoring has been active.
Note: If you have not run any scans yet, this timer does not start, since attack chains are formed only based on scan results.
Tip: You can stop the process of forming attack chains based on your configurations by clicking Stop.
Attack Chains Overview
The top of the Attack Chains page shows overall statistics on the inferred threats:
Attack Chains – Total number of attack chains built
Monitored Threats – Total number of Active Threats items that are currently used for correlation out of all Active Threats items available for correlation
Affected Hostnames – Total number of unique hosts related to the correlated events
Tagged Events – Total number of events that were used for correlation
Matched Rules – Total number of rules that matched the events used for correlation out of all underlying Sigma rules across all Higher Order Sigma rules associated with the Active Threats items that are available for monitoring
The page consists of two tabs – Attack Chains and Monitored Threats.
Attack Chains Tab
The Attack Chains tab includes a list of Attack Chains with the following details on each item:
Severity – Severity of the Attack Chain (according to the corresponding Active Threats item)
Name – Name of the Attack Chain (according to the corresponding Active Threats item)
Hostname – Host primarily associated with the detected activity
Tenant – Tenant (a group of Data Planes) associated with the detected activity
Data Plane – Data Plane associated with the detected activity
Match – Percentage of sequences from Higher Order Sigma rule that match correlated events
Matched Rules – Total number of detection rules that were used for correlation
First/Last Seen – Timestamp of the first and last correlated event included in the Attack Chain
Status – Investigation Status of the Attack Chain. Manage it on the Attack Chain details page
Use the search bar to search Attack Chains by name, hostname, or username.
Use the available controls to filter the visibility of Attack Chains:
Show Filtered Out – This button toggles the visibility of Attack Chains that the AI Agentic flow marked as false positives or low priority. By default, these chains are hidden to keep the view focused on high‑priority detections. Click to show or hide the filtered chains as needed
Group by – Group the Attack Chains by Hostname or Chain Name
All Severities – Filter Attack Chains by severity level
All Statuses – Filter Attack Chains by investigation status
All Data Planes – Filter Attack Chains by the Data Plane that contains the events used for correlation
All Tenants – Filter Attack Chains by the Tenant that contains the events used for correlation
Click the Attack Chain name or its eye icon to view details.
Attack Chain Details
Use this page as the starting point for the investigation of the detected Attack Chain. To manage the lifecycle of the Attack Chain, change its Status, which has the following values:
New
Investigating
Confirmed
False Positive
Resolved
Closed
Filtered Out – Attack Chains that the AI Agentic flow marked as false positives or low priority
General
This tab displays information about the Attack Chain that is generated after it is processed by the AI agent and enriched with contextual data using an LLM.
Key details:
Severity – According to the Associated Active Threat item
Hostname – Primary host associated with the detected activity
Tenant – Tenant associated with the detected activity
Data Plane – associated with the detected activity
Matched Rules – Total number of rules used for correlation
AI Summary – Provides a contextual overview of the detected activity.
Tags:
Techniques and sub-techniques – MITRE ATT&CK techniques used by adversaries in this threat context
Threat Actors – threat actors related to the threat
First Seen – Timestamp of the first correlated event included in the Attack Chain
Last Seen – Timestamp of the last correlated event included in the Attack Chain
Chain (techniques over time). Displays the sequence of techniques identified throughout the Attack Chain timeline. Green items represent techniques detected through standard detection rules.
List of detected techniques, where each technique has the following details:
Name and ID
Matched Rules
First Seen
Last Seen
List of rules within the detected technique. Click the technique to open the list of rules that have the following details:
Name
Index
Hits
First Seen
Last Seen
View in SIEM. Click the button to open the corresponding query in your SIEM and investigate the events associated with the selected detection.
Active Threat
This tab shows the core info from the associated Active Threats item, including:
Summary – AI-generated summary with the threat’s primary characteristics
Investigation – Recommended actions for investigating the threat
Mitigation – Recommended actions for mitigating the threat according to the best security practices
Response – Recommended response actions to minimize the risks of the threat
Attack Flow – Visualization of the adversary activity of the associated Active Threats item
Detections – List of detections related to the Active Threats item. Click the rule to open its details
Higher Order Sigma Rules
Higher Order Sigma rules are correlation rules that evaluate events from Data Planes used for scans against multi-event patterns (sequences) to detect potential Attack Chains. Higher Order Sigma rules are based on detection rules defined in Active Threats and use the Attack Flow – a sequence of attack techniques mapped to the MITRE ATT&CK framework, to determine the sequence of adversary actions.
Click Copy to copy the Higher Order Sigma rule to the clipboard, or click Download to save it in YAML format.
Monitored Threats Tab
The Monitored Threats tab includes a list of Active Threat items included in the monitoring scope. By default, it includes Active Threats from the last 35 days from the Active Threats module in Threat Detection Marketplace. New Active Threats are automatically added to this list as they are released.
You can control which Active Threats to include in monitoring by enabling or disabling them using the toggles next to each Active Threat item, or apply bulk actions to enable or disable multiple Active Threat items at once. By default, all the Active Threats from the list are included in the monitoring scope.
If a Threat item contains queries that have not been executed in any scan during the time period configured in the Lookback window, the Attack Chain cannot be formed. In such cases, an issue label is displayed on the Threat item. Click the label to open the Issue Navigator, which shows the queries that were not executed and the associated Data Plane.
If during the lookback period all the queries from this Attack Chain have been executed, a green checkmark is shown on the Threat item instead.
The Monitored Threats tab includes the following details on each item:
Severity – Severity of the Active Threat
Name – Name of the Active Threat
Affected Industries – Industries most impacted by the Active Threat
Affected Geographies – Geographical areas most impacted by the Active Threat
Threat Type – The category of the Active Threat
Release Date – The date when the Active Threat was published
Use the search bar to search Active Threats.
Use the available filters:
All Severities – Filter Active Threats by severity level
All Industries – Filter Active Threats by industries
All Threat Types – Filter Active Threats by category of the threat
All Regions – Filter Active Threats by region
Click the Active Threat name to view details.
Active Threat Details
This page provides the following information:
AI Summary – High-level view of the threat context, including:
Summary – AI-generated summary with the threat’s primary characteristics
Investigation – Recommended actions for investigating the threat
Mitigation – Recommended actions for mitigating the threat according to the best security practices.
Response – Recommended response actions to minimize the risks of the threat
Tags:
Severity – Severity of the Active Threat
Release Date – The date when the Active Threat was published
Affected Industries – Industries most impacted by the Active Threat
Affected Geographies – Geographical areas most impacted by the Active Threat
Threat Type – The category of the Active Threat
Attack Flow – Visualization of the adversary activity of the associated Active Threats item
Higher Order Sigma Rules – Correlation rule related to the Active Threats item. Click the rule to open its details. On the Higher Order Sigma rule page, you can:
Copy the rule
Download the rule in YAML format
Open the rule in Uncoder AI
Detections – List of detections related to the Active Threats item. Click the rule to open its details. On the rule page, you can:
Copy the rule
Download the rule in YAML format
Open the rule in Uncoder AI
Edit the rule