Skip to content

Start

Home
How it works

Operate

Overview
Incidents
Sati AIinvestigation agent
Observatory

Analyze

Analytics
World threatsdaily, from public sources
Sati modelsnine, trained on real data

Respond

Actions
Detections
ATT&CK coverage

Learn

Trainingcyber defence practice
Findingswhat the measurements showed
Evaluation

Built by Preet RavalSource LinkedIn

Detections

Home
Incidents
Sati AI
Learn

Search entities and incidents/

Detections

What would have caught each incident — drafted from its telemetry, or written by a person.

12 drafted · 2 written

How to read this

two kinds, kept apart

Drafted — assembled by the assistant from the stored events one step of an incident cites. Every field was read from a record, which is why most of these catch that incident and nothing else; the rule says so in its own header.
Written — by a named person, for the fields a real sensor would send. General, and not checked against any record here: it is what someone believes the technique looks like.

ShowBoth kinds Drafted Written

INC-2026-0904

the incident →

Draft: Vulnerability Scanning observed in INC-2026-0904T1595.002 Vulnerability Scanning
drafted by satidraftedindicator matchINC-2026-0904

INC-2026-0901

the incident →

Draft: Credential Stuffing observed in INC-2026-0901T1110.004 Credential Stuffing
drafted by satidraftedindicator matchINC-2026-0901
Draft: Cloud Accounts observed in INC-2026-0901T1078.004 Cloud Accounts
drafted by satidrafted

INC-2026-0902

the incident →

Draft: Steal Application Access Token observed in INC-2026-0902T1528 Steal Application Access Token
drafted by satidraftedindicator matchINC-2026-0902

INC-2026-0905

the incident →

Draft: Compromise Software Supply Chain observed in INC-2026-0905T1195.002 Compromise Software Supply Chain
drafted by satidraftedindicator matchINC-2026-0905
Draft: OS Credential Dumping observed in INC-2026-0905T1003 OS Credential Dumping
drafted by satidrafted

INC-2026-0903

the incident →

Draft: Web Protocols observed in INC-2026-0903T1071.001 Web Protocols
drafted by satidraftedindicator matchINC-2026-0903
Draft: SMB/Windows Admin Shares observed in INC-2026-0903T1021.002 SMB/Windows Admin Shares
drafted by satidrafted

○

○indicator match

INC-2026-0901

○

○indicator match

INC-2026-0905

Draft: SMB/Windows Admin Shares observed in INC-2026-0905T1021.002 SMB/Windows Admin Shares

drafted by satidraftedindicator matchINC-2026-0905

Draft: Exploitation of Remote Services observed in INC-2026-0905T1210 Exploitation of Remote Services

drafted by satidraftedindicator matchINC-2026-0905

Draft: Disk Structure Wipe observed in INC-2026-0905T1561.002 Disk Structure Wipe

drafted by satidraftedindicator matchINC-2026-0905

○

○indicator match

INC-2026-0903

Draft: Scheduled Task observed in INC-2026-0903T1053.005 Scheduled Task

drafted by satidraftedINC-2026-0903