Event details

Event details

Each event has its own page describing execution, IOC, technical results obtained, recommendations, logs and more. It is also where you get the event's detection information.



Adversary action banner

This banner gives the event name, its MITRE ATT&CK tactic and technique, the technical environment it relates to, and its severity. On the right, you can see its detection score.
Use the up and down arrows next to the event name to move between events without returning to the list.


Adversary action details



Execution details

Technical details of the event's execution:
  • Execution status. See  Event statuses & severity .
  • Source IP address
  • Target IP address and/or name
  • Start and end date & time
  • Duration
  • Exploitation status: the outcome of the adversary action from the attacker's standpoint, complementary to its execution status and independent of detection. It can be Exploited, Contained or N/A. See  Event statuses & severity .

Detection and reaction assessment

This section holds the detection and reaction information of the event. Detection can be filled in two ways, depending on the detection qualification mode chosen when the campaign was created (see  Connectors ).
In Automatic mode, BlackNoise correlates the data collected from the connector with the event and fills in the detection status, the source(s) and the detection date & time for you. In Semi-automatic mode, or when the campaign uses no connector, you qualify the detection yourself with the Add detection status button.
The default status is Unqualified; the three others are Undetected, Logged and Alerted (see  Event statuses & severity ).
In Automatic mode, BlackNoise looks for the event in the data returned by the connector. If the tool raised a matching alert, the event is set to Alerted. If it raised no alert but the execution of the event appears in its traces or telemetry, the event is set to Logged. What BlackNoise can detect depends on the connector and on the tool, because each one gives access to a different level of data (see  Connectors ). If nothing matches, the event stays Unqualified: a missing result does not prove that the event went unnoticed, so qualify it yourself, for example as Undetected.

Edit the detection status
Depending on the status, you can add the source(s) that detected the event, the detection date & time, and evidence (a screenshot of an interface, an email, or a log file). Even when BlackNoise fills in this information automatically, you can still edit it manually and complete it by uploading evidence.
For Alerted events, record the response with the Add reaction button: the action taken or final status, the date & time, and reaction evidence. Reaction information is not filled in automatically.
TTD (Time To Detect) and TTR (Time To React) are computed automatically from the dates & times recorded, whether you entered them or BlackNoise filled them in. This detection and reaction data feeds the campaign KPIs on the  Threat brief  page (cyber score, detection rate, most active sources, etc.). Qualifying every event gives complete results; status is the criterion with the most impact on the  score . Use the Edit button in each section to change the information.
When a connector is active, this section also shows the technical information that the connector returns for the event, for example the alerts raised by an EDR. BlackNoise shows everything the tool can return, so the content depends on the tool and on how closely its data matches the executed event (target, time window and, where available, the executed command). It helps you qualify the detection yourself, or check what BlackNoise filled in automatically. See  Connectors  for the available tools.

Detection status history

A banner at the bottom shows the history of this event's detection status across the campaign's simulations.

Reference panel (on the right)

This panel gives the technical description of the event, to help you understand and investigate it: the description of the executed action, the MITRE ATT&CK correlations (tactic and technique), the event type, and its severity.


IOC

The IOC tab lists, in a table, the technical markers (indicators of compromise) associated with the executed event. It helps analysts by pointing to the key markers to look for in their detection tools. These IOCs are provided either in MISP format or in a BlackNoise-specific format, and can include, for example, executed system commands or dropped files. Each IOC can be copied with its copy button.


Results

This tab gives the technical results obtained from the system commands executed by the event. They show what information, or what confirmation, an adversary obtains by executing this kind of action.


Enhance detection (recommendations)

Most events executed at OS level come with a Sigma rule, provided by the BlackNoise CERT, to complement your existing tools (EDR, SIEM, etc.) when the event was not detected. The solution also provides Suricata rules for most network-related events. You can copy or download the rule to integrate it into your defenses. Rules may need adapting to your specific tool, and you should check the rule's requirements before using it.


Comments

The Comments tab lets you exchange messages about handling the event. Each user can post comments, and edit or delete their own.
You can mention other users of your company to notify them directly of the discussion.


Logs

The Logs tab provides detailed execution logs, with full visibility into each event step, including the executed system commands and the results obtained.