Attack Narrative

Replays a correlated incident as a chronological, kill-chain-mapped story — each step showing the phase, MITRE technique, technical detail, and the indicators involved, with per-event containment and a Markdown export.

Route: /attack-narrative

How it works

Overview

What it is

The Attack Narrative Timeline reconstructs an incident as a "cinematic" sequence of events. Instead of a flat alert list, each incident is a stored narrative — a title, a summary, and an ordered array of timeline events — that the page renders as a vertical, phase-coloured story you can step through.

Kill chain phases

Every event is tagged with one of eight kill-chain phases. The page renders a progression bar across the top with these phases in order:

recon — Reconnaissance
weaponize — Weaponization
deliver — Delivery
exploit — Exploitation
install — Installation
c2 — Command & Control
actions — Actions on Objective
exfil — Exfiltration

Each phase segment shows a count of how many events fall in that phase; phases with no events are dimmed.

What each event carries

An event holds a timestamp, phase, title and description, a raw technical detail line (e.g. the exact command executed), a source (the log or sensor it came from), a severity, an optional MITRE tactic and technique, and a list of artifacts (the concrete indicators — IPs, domains, hashes, files, processes, users, commands, or emails). Events may also name an actor and a target asset.

When an organisation has no narratives yet, opening the page auto-creates one demo incident ("Operation BlackByte: Ransomware Intrusion Chain") so the timeline is never empty on first use.

Using the timeline

How to use

Pick an incident

Use the dropdown in the top-right to switch between incidents. The most recent narrative loads by default.

Filter by phase

Click any segment of the Kill Chain Progression bar to filter the timeline to only that phase's events; click it again to clear the filter and show the full chain.

Expand an event

Click an event card to expand it. The expanded view reveals:

Technical Detail — the raw command, query, or payload line
Artifacts — each indicator shown as type: value with optional enrichment context
Source, Actor, Target — provenance and, where known, the actor and impacted asset

Play it back

The playback controls (skip-back / play-pause / skip-forward) step through the events. Pressing play reveals events one at a time, advancing every 2.5 seconds and highlighting the current step until the end of the chain is reached.

Contain an event

Inside an expanded, not-yet-contained event, containment buttons appear based on the artifact types present:

Block Net Indicator — shown when the event has an ip or domain artifact
Terminate & Quarantine Process — shown when it has a process, hash, file, or command artifact
Lock Compromised Account — shown when it has a user artifact

Clicking a button marks that event as contained: the timeline dot becomes a shield and the event is labelled as under active containment. This state is persisted server-side (see the API section) so it survives a refresh.

The containment action records the event as mitigated against the narrative — it is a triage/tracking state on the timeline. Any downstream enforcement (firewall, EDR, or identity action) is handled by those respective modules, not by this endpoint.

Export the story

Export Narrative Story generates a Markdown report in the browser and downloads it as attack-narrative-.md. It includes the executive summary and every step with its description, technical detail, threat level, MITRE technique, indicators, and whether the step is mitigated or still active.

Data model & event fields

Reference

Narrative record

Each narrative is one AttackNarrative row. JSON columns store the arrays the timeline reads:

Field	Meaning
`id`	Narrative identifier (used by the API and export filename)
`incidentId`	Underlying incident this narrative belongs to
`title`	Incident title shown in the selector and header
`summary`	Executive summary paragraph
`eventsJson`	Ordered array of timeline events (see below)
`entitiesJson`	Impacted entities — IPs, users, hosts
`mitreJson`	MITRE ATT&CK technique chain
`mitigatedJson`	Event IDs an analyst has marked contained
`severity`	Overall severity (default `medium`)
`status`	`active` · `contained` · `resolved`
`organizationId`	Tenant scope

Event object (inside eventsJson)

Field	Meaning
`id`	Event identifier (the target of a containment PATCH)
`timestamp`	ISO time of the event
`phase`	One of the eight kill-chain phases
`title` / `description`	Human-readable step summary
`technicalDetail`	Raw command / payload / query line
`source`	Originating log or sensor
`severity`	`critical` · `high` · `medium` · `low` · `info`
`mitreTactic` / `mitreTechnique`	MITRE ATT&CK mapping (technique shown as a badge)
`artifacts`	Array of `{ type, value, enrichment? }`
`relatedAlertIds`	IDs of correlated alerts
`actor` / `targetAsset`	Optional attributed actor and impacted asset

Artifact types

ip · domain · hash · file · process · user · command · email — the type also determines which containment buttons appear on the event.

API endpoints

Reference

All routes live at /api/narrative/incidents, require an authenticated session, and are scoped to the caller's organisation.

List incidents

GET /api/narrative/incidents returns up to 50 narratives for the org, newest first, under an incidents array. Each incident includes id, title, severity, status, startedAt, summary, the parsed events array, mitigatedEventIds, impactedAssets, and an attackerProfile summary panel. If the org has no narratives, one demo narrative is seeded and returned.

curl https://portal.guardfoxsecurity.com/api/narrative/incidents

Contain an event

PATCH /api/narrative/incidents marks one event within a narrative as mitigated by appending its ID to mitigatedJson. Both id (narrative ID) and eventId are required; it returns the updated mitigatedEventIds array. Missing fields return 400; an unknown narrative returns 404.

curl -X PATCH https://portal.guardfoxsecurity.com/api/narrative/incidents \
  -H "Content-Type: application/json" \
  -d '{"id":"NARRATIVE_ID","eventId":"EVENT_ID"}'

Create a narrative

POST /api/narrative/incidents stores a new narrative. Body fields: title, optional incidentId, and the arrays events, entities, and mitreTechniques (serialised into the JSON columns). It returns the created record.

curl -X POST https://portal.guardfoxsecurity.com/api/narrative/incidents \
  -H "Content-Type: application/json" \
  -d '{"title":"Suspected phishing intrusion","events":[],"entities":[],"mitreTechniques":[]}'