Attack Flow - Beyond Atomic Behaviors
summary
Defenders move from isolated indicators to a reproducible sequence format: a JSON Schema/JSON‑LD/RDF attack flow format published March with an accompanying visual editor Attack Flow Designer. The project has 30 contributing orgs, 10 industry partners, and a corpus of six published flows; it encodes actions, assets, properties and causal edges so teams can emulate incidents, spot recurring motifs/choke points, query graphs for prioritized detections, and exchange partial or full flows machine‑to‑machine.
AI-written summary · about
chapters (5)
- 0:00Introduction to attack flow
- 3:30Defining the problem
- 7:03The technical solution
- 19:28Use cases and impact
- 27:01Resources and Q&A
related talks
39mLLM-Driven Attack Flow Generation from Security Publications
22mGo Flow Safe
34mMITRE Attack Flow: Laying Foundations for Predictive Intelligence
29mAttack Defense Graph Analysis for Supporting SOC and CSIRT Operations
49mThreat Modeling Toolkit
31mBringing Chronological Context to Disparate Artifacts: Accelerating Digital Forensics
33mDecoding Cyber Threats: A Practical Guide to Using Attack Trees
20mAttack of the Graph: Visual Tools for Cyber Analysis