Trellix Insights provides a graphical representation of campaign detections and associated threat actors, tools, and techniques.
Graph layout, toolbars, nodes and edges
You can view the graph in three different layouts:
Standard (default layout) - Displays a linear layout keeping link lengths consistent.
Sequential - Displays nodes in a hierarchical structure, minimizing crossed links.
Lens - Displays nodes within a circle, with connected nodes adjacent to each other.
You can perform the following actions using the toolbar:
Zoom in, zoom out, resize or use full screen mode for improved visibility.
Download the graph in high-resolution PNG format.
Nodes
A node represents a campaign which is associated with the threat actors, tools, labels, geographical location, and more.
Select a node. You can view campaign details such as the campaign description, its severity level, number of endpoints affected, number of devices with insufficient coverage, the last detected time stamp of the campaign, labels associated with the campaign.
Click View this Campaign to view more details about the campaign on the Campaign Overview page.
Edges
An edge is a connection between nodes which is a campaign and its associated threat actors, tools, labels, geographical location, and more. Each filter options in the left pane uses different edges (connection types) to connect with the campaign.
Filters | Edges |
|---|---|
Threat Actor | Attributed to |
Tool MITRE Tool | Uses Tool |
Labels MITRE Enterprise Attack Tool MITRE Enterprise Attack Malware MITRE Enterprise Attack Pattern MITRE Pre-Attack Pattern MITRE Mobile Attack Malware MITRE Mobile Attack Pattern | Associated with |
CVE | Exploits Vulnerability |
MITRE Attack Pattern | Uses Technique |
MITRE Malware | Uses Malware |
MITRE Intrusion Set MITRE Enterprise Attack Intrusion Set MITRE Mobile Attack Intrusion Set MITRE Pre Attack Intrusion Set | Uses |
MITRE Course of Action | Mitigation |
Prevalent in Sectors and Prevalent in Countries | Observed in |
Reported Sectors and Reported Countries | Reported in |