Adversary Intelligence
Adversary intelligence is evidence of what an attacker actually did inside your environment: the systems they touched, the commands they ran, the techniques those actions map to, and the order it all happened in. AMazeTM captures it from confirmed interactions with Synthetic Cognitive Agents and Neural Echoes, then correlates every event onto one unified attack chain your SOC can act on.
Most security telemetry describes what is possible. A vulnerability scan says a host could be exploited. A threat feed says an address has been malicious somewhere else. An anomaly score says a login looked unusual. None of it says what an adversary did here, and analysts spend most of their time trying to find out.
Synthetic Cognitive Agents mirror real infrastructure that no legitimate user or service has any reason to touch, and Neural Echoes are credentials and artifacts that only an adversary would collect and replay. An interaction with either is not a probability. It is a confirmed adversary, observed in the act, with full context from the first packet.
AMazeTM records those interactions as Neural Events, enriches them, maps them to the techniques they represent, and correlates them across IT, OT, identity and AI environments into a single attack chain. That record is adversary intelligence: specific to your environment, produced by the adversary's own actions, and ready for triage, investigation, containment and long-term tuning.
How AMazeTM Captures Useful Evidence
Every confirmed interaction becomes a ready-to-investigate Neural Event: source and destination, protocol, threat score, mapped MITRE ATT&CK techniques, geolocation, reputation, the raw log line and a clear path to remediation, all correlated onto one unified attack chain.
Behavior Timeline
See the sequence of touches, access attempts, commands, tools and movement decisions in each confirmed interaction, in the order the adversary made them.
Technique Context
Map adversary behavior to MITRE ATT&CK, ATT&CK for ICS and MITRE ATLAS, covering reconnaissance, credential access, privilege paths, lateral movement, industrial control manipulation and attacks on AI systems.
Artifacts Where Available
Capture malware samples, scripts, payloads and dropped files when an interaction delivers them, and hold unknown samples for analysis.
Adversary intelligence versus threat intelligence
Threat intelligence and adversary intelligence answer different questions. A threat intelligence feed describes the world outside your network: indicators seen elsewhere, actor profiles, reputation scores for addresses and domains. It is broad, shared and probabilistic, and it is most useful for enrichment. Adversary intelligence describes what happened inside your own environment, produced by an adversary who is already there. It is narrow, specific and certain.
AMazeTM uses both. Threat feeds enrich each Neural Event with reputation and geolocation, through your own IPQualityScore, AbuseIPDB and VirusTotal keys, MirrorMire's cloud enrichment, a self-hosted enrichment service, or none at all if policy requires it. The intelligence itself comes from the interaction, and it does not depend on any feed being right.
| Threat intelligence feed | Adversary intelligence from AMazeTM | |
|---|---|---|
| Source | Observations from other networks, shared indicators, vendor research | The adversary's own actions against mirrored systems in your environment |
| What it tells you | This address or hash has been malicious somewhere | This adversary did these things, here, in this order |
| Certainty | Probabilistic. Indicators age, and they collide with legitimate traffic | Confirmed. No legitimate user has a reason to touch the source |
| False positives | Common, and each one costs analyst time | None. Every interaction is an adversary by definition |
| Timing | After an indicator is published, often weeks after its first use | As the interaction happens |
| Knowledge of your assets | None. A feed knows nothing about what you run | Complete, for every mirrored system and seeded artifact |
| Best use | Enriching and prioritising events | Triage, investigation, containment and tuning |
Anatomy of a Neural Event
A Neural Event is the unit of adversary intelligence in AMazeTM. It is created the moment an adversary interacts with a Synthetic Cognitive Agent or activates a Neural Echo, and it is classified and enriched before an analyst sees it. Each event carries the fields below, and every one of them is available to the dashboard, to AMazeTM Analyst, and to any tool you dispatch the event to.
| Field | What it holds | Why it matters |
|---|---|---|
| Timestamp and site | When it happened and which site, plant or region owns the asset | Orders the timeline and scopes it to the team responsible |
| Network segment | External, internal, OT or identity, classified automatically from the source address and protocol | Separates opportunistic scanning from lateral movement inside the network at a glance |
| Protocol and service | SSH, RDP, SMB, HTTP, database protocols, Modbus, DNP3, S7comm, Kerberos and more, plus the mirrored system that answered | Shows what the adversary believed they had reached |
| Source and destination | Adversary address and port, the mirrored system's address, and the geolocation of the source | Anchors correlation across events and feeds containment |
| Threat score | A severity score for the interaction. Events at 90 or above open a ticket automatically | Sets priority without a human reading every line |
| Reputation and enrichment | Fraud score, proxy detection, engine detections and abuse confidence from the configured feeds | Adds outside context to inside evidence |
| Techniques | MITRE ATT&CK, ATT&CK for ICS or ATLAS technique identifiers, mapped from the log line and protocol | Puts the behavior in the language the rest of the SOC already speaks |
| Credentials and identity | The username attempted, and whether it was a Neural Echo chained to the login that used it | Proves harvesting and replay rather than guessing |
| Raw log line and payload | The exact command, request or packet the adversary sent | Evidence, not a summary |
| Artifacts | Malware samples, scripts and dropped files, held for analysis when an interaction delivers them | Material for reverse engineering and new detection rules |
| Attack chain | The unified chain this event belongs to, across segments | One story per adversary instead of dozens of alerts |
Mapped to ATT&CK, ATT&CK for ICS and ATLAS
AMazeTM classifies every Neural Event into a network segment and maps the behavior to the framework that fits it. The mapping is applied at ingest, so the technique is on the event before an analyst opens it, and it feeds the technique coverage view in the executive dashboard and the signed reports built from it.
| Segment | Framework | Typical techniques | Where it is observed |
|---|---|---|---|
| External | MITRE ATT&CK | Active scanning, brute force (T1110), exploitation of public-facing applications, web shell attempts | Internet-facing Synthetic Cognitive Agents such as SSH, RDP and web services |
| Internal | MITRE ATT&CK | Discovery, use of valid accounts, remote services, lateral movement over SMB and RDP | Mirrored servers and databases inside the network, and Neural Echoes seeded on real hosts |
| Identity | MITRE ATT&CK | Brute force and password spraying against directory services, use of harvested domain credentials | A mirrored Windows domain controller and seeded domain credentials |
| OT and ICS | MITRE ATT&CK for ICS | Unauthorized command messages, manipulation of control (T0831), device and program discovery | Mirrored PLCs and controllers speaking Modbus, DNP3, S7comm, EtherNet/IP and BACnet |
| AI | MITRE ATLAS and the OWASP LLM Top 10 | Prompt injection, jailbreak attempts, tool and function abuse, retrieval poisoning, credential exfiltration through an agent | AI-layer Synthetic Cognitive Agents and AI Neural Echoes placed in tool schemas and retrieval context |
From interaction to the SOC
Adversary intelligence is only useful if it reaches the people and systems that act on it. AMazeTM correlates related Neural Events into one unified attack chain per adversary, across segments, so an external probe, the internal movement that followed it and the credential replay that ended on a mirrored domain controller read as one story rather than three alerts.
Events at or above the actionable threshold open a ticket automatically and can be dispatched to the tools your team already runs. Outbound integrations cover webhooks, Slack and Microsoft Teams, and a generic HTTPS shape that lands in Splunk, Wazuh, Elastic, Cortex XSOAR, ServiceNow, Jira, PagerDuty or any endpoint that accepts JSON. High-severity dispatches can be gated behind an analyst approval with a mandatory comment, deliveries retry with backoff, and every attempt is recorded so delivery can be audited without reading logs.
AMazeTM Analyst, the in-product SOC assistant, answers questions over the same telemetry with read-only queries and reconstructs a campaign in plain language, so the first draft of an incident report is a question away. Scheduled, signed CISO and board reports summarise the intelligence over time, including technique coverage across the frameworks above.
Common questions
- What is adversary intelligence?
- Adversary intelligence is evidence of what an attacker actually did inside your environment, captured from confirmed interactions with mirrored systems and seeded artifacts and correlated into one attack chain. It differs from threat intelligence, which describes activity seen elsewhere, in that it is specific, certain, and produced by the adversary's own actions against you.
- How is it different from a threat intelligence feed?
- A feed tells you an indicator has been malicious somewhere. Adversary intelligence tells you what this adversary did here, in what order, using which techniques. AMazeTM uses feeds to enrich events with reputation and geolocation, but the intelligence itself comes from the interaction.
- What is a Neural Event?
- The record AMazeTM creates when an adversary interacts with a Synthetic Cognitive Agent or activates a Neural Echo: timestamp, site, network segment, protocol, source and destination, threat score, enrichment, the mapped MITRE technique, the raw log line, any artifacts, and the attack chain it belongs to.
- Which frameworks are the techniques mapped to?
- MITRE ATT&CK for IT and identity activity, ATT&CK for ICS for operational technology, and MITRE ATLAS with the OWASP LLM Top 10 for attacks on AI systems. Mapping happens at ingest, so the technique is on the event before an analyst opens it.
- How does it reach my SIEM or SOAR?
- Actionable events are dispatched over HTTPS as webhooks, Slack or Microsoft Teams messages, or a generic JSON shape that lands in Splunk, Wazuh, Elastic, Cortex XSOAR, ServiceNow, Jira, PagerDuty and similar tools. Dispatches can be gated behind analyst approval, retried with backoff, and every attempt is recorded.
- Can it produce false positives?
- No. Mirrored systems and seeded artifacts have no legitimate users, so an interaction is a confirmed adversary rather than an anomaly. What analysts receive is evidence to investigate, not a score to second-guess.
Turn Interaction Into Intelligence
See how confirmed-adversary evidence gives analysts a better starting point than another alert.
Request a Demo