The whole attack on one page
How far it got, stage by stage, which machines and accounts it touched and how long it has been running. In our lab, twelve alerts from five rules were joined into one attack that ran from discovery to collection.
Campaigns
Attacks, not just alerts.
Alerts that belong to the same attack are joined into one campaign, so your team works the attack once instead of chasing its pieces one alert at a time.
One attack, many alerts.
An attacker who gets in will look around, collect what they find and try to stay. Each step can set off a different rule.
Pieces without a story
Twelve alerts from five rules look like twelve problems, until someone sees they are one.
Worked twice
Different people pick up alerts from the same attack and repeat each other’s searches.
How far did it get?
Without the stages in order, it is hard to say whether the attacker is still looking around or already taking data.
Plans that conflict
Separate fixes for separate alerts can miss a machine, or undo each other.
Twelve alerts, one attack.
Alerts from the same attack are joined and set out in time and by stage, so the story reads from first step to latest.
One attack, twelve alertsFrom our lab
- Reconnaissance
- Resource development
- Initial access
- Execution
- Persistence
- Privilege escalation
- Defence evasion
- Credential access
- Discovery
- Lateral movement
- Collection
- Command and control
- Exfiltration
- Impact
12 alerts from 5 rules → 1 campaign, discovery to collection
In the order it happened
The attack chain sets the alerts out in time and by MITRE ATT&CK stage, so you can read the attack from its first step to its latest.
What it puts at risk
Which business processes and important systems a campaign touches, from what you told armor360 about your company when you set it up.
One plan, approved by people
A coordinated plan says what each affected machine and account needs. Every step waits for a person to approve it, and your team carries it out with its own tools.
How a campaign comes together.
- 1
Alerts share something
Two or more alerts name the same machine, account or address within about two hours of each other, even when different rules raised them.
- 2
They are joined
armor360 joins them into one campaign. Each alert stays linked to its own investigation, so the reasoning behind each piece can still be opened and checked.
- 3
The attack is laid out
The campaign shows the MITRE ATT&CK stages from first to latest, the machines and accounts touched, how long it has run and which business processes are at risk.
- 4
People approve the plan
One coordinated plan says what each affected machine and account needs. Each step waits for a person to approve it, and your team carries it out.
Built for the attack as a whole.
Joined automatically
Alerts that name the same machine, account or address close together in time are joined without anyone tagging them.
ATT&CK stages
Each alert is placed on its MITRE ATT&CK stage, from discovery to collection and beyond.
Still under way?
The Today page flags attacks that may still be running, so they are checked first.
Everything it touched
Machines, accounts and business processes in one list.
One record
The campaign keeps the investigations, verdicts and decisions together for later review.
People approve each step
Nothing in the plan happens until a person says so.
One attack, by hand and with armor360.
TopicBy hand todayWith armor360
Spotting the linkSomeone has to notice that alerts from different rules share a machine or account, usually by chance or memory. Alerts naming the same machine, account or address within about two hours are joined without anyone tagging them.
Who works itAlerts from one attack are picked up by different people, who repeat each other’s searches without knowing it. The team works the campaign once, with each alert’s investigation already attached to it.
How far it gotPutting the steps in order means building a timeline by hand from tickets, notes and saved searches. The attack chain sets the alerts out in time and by ATT&CK stage, from the first step to the latest.
What is at riskThe business impact is worked out separately, often after the technical picture is finished. The campaign lists the business processes and important systems it touches, from your answers at set-up.
The planSeparate fixes for separate alerts can overlap, conflict or leave an affected machine out altogether. One plan covers each affected machine and account, and each step waits for a person’s approval.
Frequently asked questions
How does armor360 know alerts belong together?
It looks at what the alerts share. Alerts from your tools that name the same machine, account or address within a couple of hours of each other are joined into one campaign, and each one stays linked to its own investigation so you can check the reasoning.
Can a campaign span several machines?
Yes. A campaign lists every machine and account it touched. The plan then says what each one needs, and every step waits for a person to approve it.
Does armor360 carry out the plan?
No. The plan is a recommendation. Your team approves each step and carries it out with its own tools. armor360 keeps the record of who approved what and when.
Read next
More of the platform
See where your team’s time goes. Then decide.
Start a free pilot on your own alerts, or put in your own numbers first.