An account signs in. A remote service starts. A process accesses a sensitive resource. Each observation may have a legitimate explanation. Understanding whether they form a meaningful sequence requires more than putting three alerts next to each other.

Multistage attack detection in Threat Foundry uses Detection Chains to connect ordered stages, stable entity identities and explicit time windows. The investigation retains the observations behind those connections as it develops, giving analysts a sequence they can examine rather than a conclusion they must simply trust.

Define the sequence before joining the events

A chain profile describes the stages of interest and the conditions that connect them. The order matters, as do the permitted time intervals and the entities that must remain consistent between stages.

Consider a sequence involving an unusual authentication, remote service activity and a later privileged action. The analyst needs to know which identity authenticated, which host received the connection and whether the later action belongs to the same relevant entities and time window. Events that only share a common word or an ambiguous address do not supply that answer.

Preserve identity across provider-native evidence

Different security platforms express users, hosts, timestamps and event relationships differently. A useful connection needs the provider’s native evidence mapping and the exact source context, rather than a field rename that hides an unresolved identity.

Threat Foundry’s chain workflow retains entity bindings and provenance alongside the stage evidence. Versioned mappings and explicit time bounds make the basis of a connection inspectable. Tenant boundaries and execution permissions remain in force throughout the workflow.

This is particularly important for shared infrastructure. A public address, a recycled hostname or an account name without its namespace can describe more than one entity. Ambiguity belongs in the evidence assessment.

Bring intelligence and hunting into the same engine

Detection Chains is shared by eligible saved-hunt and Comprehensive Auto Triage entrypoints. A reviewed hunt can contribute its retained observations. An authorized Auto Triage policy can connect eligible intelligence to the multistage workflow.

Unified CTI ML supports the upstream questions: what belongs together, what changed, what is relevant and what deserves action. The chain then addresses a different question: which observed stages meet the profile’s entity and temporal requirements?

Using one engine keeps that transition coherent. The team can follow the intelligence context into the investigation while retaining the distinction between a model suggestion, a planned hunt and observed stage evidence.

Keep one evolving investigation

Stage evidence does not always arrive together. One query may complete while another is unavailable or returns only a partial result. Retaining one investigation gives the analyst a place to inspect completed work, unresolved stages and subsequent recovery.

  • Preserve the source observations behind each stage and connection.
  • Keep the chain profile, entity bindings and time windows available for review.
  • Retain partial, failed and pending states with their actual limitations.
  • Record recovery against the existing investigation instead of presenting repeated work as unrelated new findings.

A connected sequence is evidence for investigation. Analyst review still determines what the activity means, whether an incident is established and what response is appropriate.

Use Entity Analyzer to inspect the supporting activity

Entity Analyzer provides six complementary views of hunt evidence. Timeline reconstructs event progression; Network Analyzer follows communication paths; Process Analyzer exposes parent-child execution; Command Analyzer traces command lines and referenced observables; DNS Analyzer connects queries, aliases and returned addresses; and Lateral Movement follows account and host movement across systems.

The lateral movement view illustrates how these perspectives support investigation: analysts follow source and destination hosts, movement methods and multi-hop paths, then select an entity to inspect its supporting observations and context. Entity filtering, exact local Intelligence Library matches and related ATT&CK pivots help connect those observations to follow-up work.

The graph supports exploration; the stage and event evidence supports the conclusion. Observed, correlated and inferred relationships should remain distinguishable, especially when a path is incomplete or depends on assumptions.

Connect detection to the operating workflow

The combination of unified intelligence, authorized Auto Triage and multistage detection connects the reason to investigate with the work performed and the evidence collected. ATT&CK coverage helps teams examine relevant behaviors and gaps; Detection Strategies preserve intent, assumptions and review guidance around the detection work.

Explore multistage attack detection, view entity and lateral movement analysis, or discuss an attack sequence relevant to your environment.