Mobula · Attack Storyline
A wall of alerts,
told as one story.
Mobula correlates alerts across time, hosts, and identities into a single attack narrative - then writes it up, maps it to the MITRE kill chain, and predicts the attacker's next move. Analysts read a story, not a queue.
Alerts arrive already grouped into stories
The correlation engine follows the entity graph and the kill chain - not just shared indicators - so related alerts across hosts, users, and time land as one storyline. Split by Users and Hosts, ranked by severity.
| Severity | User | Title | Alerts | Entities | Last activity | Status |
|---|---|---|---|---|---|---|
| HIGH | p.alvarezENTRY | Credential harvesting → lateral movement to finance T1566 · T1078 · T1021 +3 | 14 | 6 | 12m ago | ACTIVE |
| CRITICAL | svc-backupPIVOT | Service-account abuse → ransomware staging T1078 · T1486 +2 | 22 | 9 | 3m ago | ACTIVE |
| MEDIUM | m.chenTARGET | Impossible-travel sign-in cluster T1078 · T1110 | 5 | 2 | 1h ago | DORMANT |
| HIGH | DC-01PIVOT | Kerberoasting → domain-controller enumeration T1558 · T1087 +1 | 9 | 4 | 26m ago | PROMOTED |
Every stage, on the ATT&CK kill chain
Each alert is plotted against the MITRE tactic it belongs to and the moment it happened - so the recon → access → lateral-movement → exfil arc is obvious at a glance. Dimmed dots are precursor “hunting” signals.
Know the next move before it happens
The AI reads how the attack has unfolded and forecasts the most likely next tactics - each with a confidence score and a concrete step to harden before the attacker gets there.
See exactly who's connected - and why
The blast-radius map pins every host and identity by its role - entry, pivot, target - and labels each link with the reason two alerts were joined. The scope of a breach in one picture.
Correlated · narrated · predicted
From noise to narrative - automatically.
Attack Storyline turns scattered alerts into one attributed, readable incident, with the attacker's next move already on the board. Promote the whole story to a case in a click.