Product and technical questions.

NetMetria is a cybersecurity network dataset generation platform. It creates ATT&CK-aligned network traffic from supported scenarios and records the associated ground truth. NetMetria Explorer is the current Linux-based release.

Packet replay sends traffic from an existing capture. NetMetria Explorer creates a new capture from a supported scenario that defines the hosts, roles, behavior order, timing, and expected network-observable activity. The PCAP is delivered with the scenario timeline and ground truth for that run.

NetMetria is focused on network-observable evidence. It does not reproduce endpoint execution state such as process creation, file-system changes, memory artifacts, EDR telemetry, or proof that an exploit succeeded on a host. Those observations require an environment capable of producing endpoint-level evidence.

No. Current Explorer scenarios focus on post-compromise network activity. They begin with an initial foothold already established and generate the network evidence associated with activity that follows. The current samples do not model or execute the initial exploit, malware delivery, or endpoint compromise itself.

Future scenarios may represent the network-observable portion of initial access or pre-foothold activity, but NetMetria is not intended to become an exploit framework.

The generated dataset includes structured information describing expected activity and preserving attribution between generated evidence and the scenario activity it represents. This provides a known reference for comparing observed results with the intended dataset.

ATT&CK describes and classifies behavior; it does not define the packets that must represent that behavior. NetMetria maps supported behaviors to defined network-observable interactions and generates the corresponding packet evidence. Associated ground truth preserves the ATT&CK attribution for that generated evidence.

The current Explorer/MVP scope includes 15 ATT&CK-aligned behaviors. The sample evidence page lists the approved behavior names and technique IDs.

A host or supporting traffic actor is included when it has a defined role in the scenario. Unrelated systems are not added just to imitate a complete enterprise network.

It means a supported scenario can be generated again from its defined inputs so results can be compared across exercises, validation runs, regression tests, and analysis.

No. Explorer generates network traffic associated with supported declared behaviors. It does not run malware, exploit systems, create live command infrastructure, emulate complete operating systems, or change endpoint state.

Realism is evaluated across the generated network evidence, not by whether individual packets merely decode correctly. Supported traffic is evaluated for packet correctness, transport and session coherence, application conversation coherence, endpoint and network-profile consistency, cross-protocol consistency, service identity, whether the evidence plausibly represents the declared behavior, and whether the PCAP is coherent as a whole. Explorer does not claim to reproduce every characteristic of a live endpoint or production network.

No. Explorer is the current release focus. Workbench is the planned direction for broader authoring and operational workflows. Enterprise remains a future organizational offering. Final scope, packaging, and timing may change.

The evaluation form is used to understand how you expect to use NetMetria and to provide relevant Explorer release or evaluation information. Submitting a request does not guarantee pre-release access or participation in an evaluation group.