Sample evidence

Inspect a generated capture with ground-truth attribution.

Inspect a generated 26-minute capture containing campaign activity mixed with background traffic. Manifest-derived ATT&CK filters link selected packet evidence to the generated ground truth.

Inspect evidence Return to homepage

Capture overview

The capture contains campaign traffic and supporting background traffic.

Loading capture interpretation...

Loading...Total packets

Loading...Total flows

Loading...Participating hosts

Loading...ATT&CK techniques

Campaign evidence

Loading... attributed packets

Loading... flows are linked by the generated manifest to the 15 ATT&CK-aligned campaign steps.

Ambient activity

Loading... background packets

Loading... flows provide surrounding DNS, HTTP, TLS, NTP, SMB, and service activity without inheriting campaign attribution.

Selected evidence

Selected campaign evidence from the capture.

These packets belong to flows linked by the manifest to specific campaign steps. The ATT&CK labels come from that ground truth, not from packet inspection alone.

Loading selected evidence...

ATT&CK evidence map

Packet membership for each campaign step.

Each row shows the behavior, ATT&CK technique, number of attributed packets, and the exact frame ranges supplied by the generated manifest.

Manifest-derived campaign packet membership
Behavior	Technique	Packets	Frame range(s)
Loading manifest-derived coverage...

The packet list shows the traffic. NetMetria ground truth supplies the scenario attribution.

The ground truth links generated traffic to scenario behavior and ATT&CK technique. The ATT&CK labels are not inferred from packet contents.

Packet-list transcript

Filter the supplied packet-list export.

Loading attribution source...

Loading sample source...

LOADING SAMPLE TRANSCRIPT ATT&CK ATTRIBUTION COMES FROM MANIFEST RANGES

Loading packet-list export...