Continuous cyber monitoring

Continuous cyber monitoring

Track how your detection and response evolve over time


By re-running the same campaign regularly, continuous monitoring turns a one-off assessment into a trend. Every replay executes the same events against the same scope, so you can see whether you are detecting and reacting faster, and whether new rules or tools are paying off. Concretely, this lets you track your Mean Time to Detect (MTTD) and Mean Time to React (MTTR), spot failures in the detection chain (log loss, interrupted alerting) and measure the benefit of newly deployed detection rules or tools.
With a connector in Automatic mode, each replay is qualified without manual effort, which makes frequent replays easy to sustain.
To follow your exposure instead, see  Attack surface management .


1) Set a baseline from a completed simulation

Once a simulation is Completed and its detection data is filled in (automatically with a connector in Automatic mode, or manually: source, date & time, and evidence if you choose), it gives you actionable results and a simulation grade. This is the baseline you compare against.


2) Replay the campaign

    Start the replay with the Create simulation button.
    Adjust the new simulation's parameters as needed, these are the same settings as when creating a campaign:
  • Select an Attack Vector. A connection test runs against each target.
  • Configure the start and chaining conditions.
    Review the summary, then click Launch, or Plan for a scheduled run.
The number of simulations allowed per campaign depends on your subscription. The connectors, and the detection qualification mode of each, are those chosen when the campaign was created: every replay is qualified the same way.


3) Record detection information

As with the first simulation, qualify the detection of each executed event. In Automatic mode, BlackNoise fills in the detection status, source and date & time from the connector data, and you can add evidence. Otherwise, set the detection status yourself and enrich it with the detection source, date & time, and evidence.


4) Compare the results over time

Each new simulation is compared with the previous one, so your detection and response become a trend rather than a snapshot. Scores, graphs and KPIs (including MTTD and MTTR) update in real time, with percentage changes showing whether your detection is improving or degrading, where the detection chain is failing, and what recent rules or tools have changed.
In Automatic mode, the detection indicators (including MTTD) are available as soon as the connector data has been gathered, with no manual qualification, so each replay can be compared immediately. Reaction indicators, such as MTTR, still depend on the reactions you record.
A campaign holds several simulations, each replaying the same scenario exactly as before. When you open a campaign, the most recent simulation is selected by default, and every tab (Threat brief, Kill chain, Attack surface, ATT&CK matrix, Activity logs) uses its data. To view another run, use the Simulation list at the top of the screen.