Threat brief

Threat brief

The campaign's technical view — key indicators and graphs for the selected simulation.


For the meaning of the statuses and the severity used below, see  Event statuses & severity . For the scoring method, the grades and the Simplified Kill Chain, see  Scoring & grades .
Automatic evaluation. When a campaign uses a connector in Automatic mode, BlackNoise fills in the detection data itself (statuses, sources, detection dates & times) from what the connector returns. The simulation grade and the detection indicators below are then established directly, with no manual qualification, as soon as the connector data has been gathered at the end of the simulation. You can still edit any status afterwards, for example to qualify the events the connector left Unqualified. See  Connectors .



Simulation grade

The average score of all events in the selected simulation, measuring how well the simulated attacks were detected. See the scoring method in  Scoring & grades . The page also shows the number of executed events and the total execution time. From the second simulation onward, results are compared with the previous one, showing the percentage change for each measure.


Detection efficiency

  • Status synthesis: distribution of events across the four detection statuses.
  • Mean Time to Detect (MTTD): average time between an event's execution and the resulting alert; computed for Alerted events with detection dates & times.
  • Detection per severity: detected (Alerted) events by severity.
  • Sources for Alerted & Logged events: the tools that detected the attacks; helps spot your most effective and under-exploited sources.


Reaction efficiency

  • Reaction status: distribution across Reacted and Ignored.
  • Mean Time to React (MTTR): average time between the alert and the applied response; computed for Alerted events with detection and reaction dates & times.
  • Reaction per severity: events with a reaction, by severity.
  • Reaction strategy: the response actions taken; an event can have several.
Reaction information is entered by you, including when a connector is used in Automatic mode: these indicators are complete once you have recorded the reactions (see  Event details ).



Detection coverage — Simplified Kill Chain

Distribution of executed events across the three BlackNoise Simplified Kill Chain phases.


Detection coverage — MITRE ATT&CK

Distribution across the MITRE ATT&CK tactics — the adversary's goal, the "why" behind a technique. You can hide or show empty tactics and switch between a split or grouped view.