How can we verify if our current EDR solution is actually capable of detecting sophisticated lateral movement techniques used by modern threat actors?
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
How can we verify if our current EDR solution is actually capable of detecting sophisticated lateral movement techniques used by modern threat actors?
2 real searches · 1 real-search pass
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classifying 2 queries…
Searches and sources
ChatGPT2 real searches · gpt-6
MITRE ATT&CK lateral movement techniques detection guidance EDR adversary emulation evaluation Atomic Red Team Caldera Google ↗
NIST endpoint detection response testing cybersecurity control validation adversary emulation guidance Google ↗
- MITRE CALDERA · caldera.mitre.org
- Atomic Red Team repository · github.com
- MITRE ATT&CK Evaluations · attackevals.mitre.org
- CALDERA™ · mitre.org
- Adversary Emulation Plans · attack.mitre.org
- ATT&CK® Evaluations · attackevals.mitre.org
- Breach and Attack Simulation · owasp.github.io
- ATT&CK® Evaluations · attackevals.mitre.org
- Sightings Ecosystem: A Data-driven Analysis of ATT&CK in the Wild · info.mitre-engenuity.org
- Lateral Movement, Tactic TA0008 - Enterprise · attack.mitre.org
Queries
2 queries · click a column to sort
| Query / type | Search | Intent | Query class | Routing format | Cluster | Freq ↓ | Weight |
|---|---|---|---|---|---|---|---|
MITRE ATT&CK lateral movement techniques detection guidance EDR adversary emulation evaluation Atomic Red Team Caldera OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
NIST endpoint detection response testing cybersecurity control validation adversary emulation guidance OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 |