Attack Chains
The full kill chain, before you close the first ticket
Attack chain reconstruction correlates findings across entities, sessions, and time using the entity graph. When a case opens, the chain of attacker actions — initial access, enumeration, lateral movement, data staging — is already assembled.
How chain reconstruction works
The investigation agent starts from a triggering finding and traverses the entity graph backward and forward in time. It follows edges — login sessions, API calls, file access, role assumptions — that connect the triggering entity to other entities with anomalous activity in the same window.
Each hop in the chain is annotated with the MITRE ATT&CK technique it represents: Initial Access, Privilege Escalation, Lateral Movement, Collection. The chain is displayed as a timeline with branching paths when multiple entities are involved.
- Graph traversal bounded by a configurable time window (default 72 hours)
- Each hop requires a minimum edge confidence score
- Chains that reach critical assets are highlighted automatically
- Competing chain hypotheses are ranked by evidence density
What a reconstructed chain looks like in practice
T1566 — Phishing
09:14 UTC
alice@corp.com
Clicked link in external email; credential harvested via AiTM proxy
T1078 — Valid Accounts
09:22 UTC
alice (stolen session)
Session token replayed from IP 198.51.100.42; MFA bypassed via cookie theft
T1087 — Account Discovery
09:25 UTC
alice (stolen session)
Enumerated Okta user list via /api/v1/users with read:users scope
T1552 — Credentials in Files
09:38 UTC
prod-api-server (EC2)
Lambda function listing S3 objects in secret-store bucket — first time in 90 days
Why attack chain reconstruction changes investigations
Scope before containment
Knowing the full chain before containing anything prevents partial remediation. If lateral movement reached three hosts, isolating only the first one leaves the attacker operational.
Timeline for legal and compliance
The reconstructed chain is timestamped, entity-attributed, and evidence-cited. It becomes the incident timeline for breach notification, legal hold, and regulator response — without manual reconstruction.
MITRE coverage gaps visible
Chain annotations show which ATT&CK techniques appeared in real incidents at your organization. Coverage mapping can cross-reference these against your detection rule library.
Hypothesis ranking
When multiple plausible chains exist, the agent ranks them by evidence density and entity criticality. Analysts review the highest-confidence chain first, not an arbitrary ordering.
Shared chain across cases
If an attack chain spans multiple cases — one for the phishing, one for the lateral movement — the chain view links across case boundaries and shows the unified attacker narrative.
Chain-level containment actions
Response workflows can target the chain as a unit: isolate all entities in the chain, revoke all credentials touched, block all external IPs observed — in one action rather than one-by-one.
Attack Chains — FAQ
How far back can a chain reach?
Chain traversal follows the entity graph retention window, which is 180 days by default. If initial access occurred months before detection, the chain can still be reconstructed provided the underlying events are retained.
What if the attacker used a shared account?
Shared account activity is flagged as ambiguous in the chain. The graph shows which sessions overlapped on the shared credential and surfaces behavioral deviations specific to the suspect sessions rather than the entire account history.
Can I manually extend or edit a reconstructed chain?
Yes. The chain view allows analysts to add manual hops with a note, link external evidence (e.g., endpoint forensic findings not in the telemetry), and annotate ATT&CK techniques on manual hops.
Is chain reconstruction available for cloud-only environments?
Yes. The chain engine works wherever you have entity graph coverage. Cloud-only environments with CloudTrail, GuardDuty, and Entra ID typically have sufficient coverage for complete chain reconstruction.
How does attack chain reconstruction reduce mean time to investigate?
Traditional investigation requires analysts to pivot across multiple tools, correlating disparate log sources manually. ManySignal pre-computes the chain from the moment a finding fires — analysts open a case to a fully assembled kill-chain view rather than spending hours on manual correlation.
Are attack chains automatically mapped to MITRE ATT&CK?
Yes. Each hop in a reconstructed chain is annotated with the ATT&CK tactic and technique the behaviour maps to. The full chain shows the progression from initial access through to impact alongside ATT&CK navigator-compatible coverage.
Can chains span on-premises and cloud environments?
Yes. The entity graph correlates identities and assets across on-premises Active Directory, cloud IAM, SaaS applications, and endpoints. A chain that begins with a phishing email, pivots through an on-premises server, and terminates in a cloud storage exfiltration is reconstructed end to end.
How is the chain used to determine blast radius before containment?
At the moment a chain is reconstructed, the blast-radius engine traverses the graph from the deepest confirmed attacker-controlled node and estimates the reachable resource set. This estimate is attached to the case and informs which containment actions the autonomy ladder permits to execute automatically.
What data sources contribute most to chain completeness?
Identity provider logs (Okta, Entra ID), cloud audit logs (CloudTrail, Azure Monitor), and endpoint telemetry (CrowdStrike, SentinelOne) are the three highest-value sources for chain completeness. Email gateway and network flow data fill gap stages for phishing and lateral movement respectively.
See the full attack before you contain anything
Book a walkthrough of attack chain reconstruction on a simulated incident matching your cloud environment.