Threat brief

Threat brief

The campaign's technical view — key indicators and graphs for the selected simulation.


For the meaning of the statuses, severity, scores and Simplified Kill Chain used below, see  Scores & statuses .



Simulation grade

The average score of all events in the selected simulation, measuring how well the simulated attacks were detected. See the scoring method in  Scores & statuses . The page also shows the number of executed events and the total execution time. From the second simulation onward, results are compared with the previous one, showing the percentage change for each measure.


Detection efficiency

  • Status synthesis: distribution of events across the four detection statuses.
  • Mean Time to Detect (MTTD): average time between an event's execution and the resulting alert; computed for Alerted events with detection dates & times.
  • Detection per severity: detected (Alerted) events by severity.
  • Sources for Alerted & Logged events: the tools that detected the attacks; helps spot your most effective and under-exploited sources.


Reaction efficiency

  • Reaction status: distribution across Reacted and Ignored.
  • Mean Time to React (MTTR): average time between the alert and the applied response; computed for Alerted events with detection and reaction dates & times.
  • Reaction per severity: events with a reaction, by severity.
  • Reaction strategy: the response actions taken; an event can have several.



Detection coverage — Simplified Kill Chain

Distribution of executed events across the three BlackNoise Simplified Kill Chain phases.


Detection coverage — MITRE ATT&CK

Distribution across the MITRE ATT&CK tactics — the adversary's goal, the "why" behind a technique. You can hide or show empty tactics and switch between a split or grouped view.