Scenario 4
Preview — execution disabledThreat correlationAdvancedMulti-Agent Attack Chain Analysis
Several narrow agents stitch independent findings into a candidate attack chain — which stays a hypothesis until independent evidence corroborates it.
A single alert rarely tells you what happened. Reconstructing an attack means collecting findings that were observed independently — a log entry here, a process event there, a configuration change somewhere else — and asking whether they belong to the same story. This scenario is a static architectural walkthrough of how a small set of narrow agents does that: one aggregates independent findings, one orders them in time, one proposes a chain that would explain them, one looks for independent corroboration, and one estimates impact. No single agent gets to declare the chain true on its own.
Everything below is a conceptual architecture driven by a synthetic trace. The scenario, the service and the findings are fictional, there is no external target, and nothing executes — no logs are queried, no model runs, and no system is touched. The point is the reasoning discipline: how a correlation becomes a hypothesis, how a hypothesis is tested, and how impact is reported with its uncertainty attached.
Honesty
A reconstructed chain is a HYPOTHESIS until independent evidence corroborates each link. Correlation is not causation: findings close in time may share a cause, or may simply coincide. Impact is estimated under stated assumptions, never proven. The architecture keeps those distinctions explicit rather than collapsing them into a confident narrative.
Preview Mode — Execution Disabled
This laboratory is currently available for architectural exploration and educational demonstrations only. Live agent execution and security testing are disabled. Operational access requires prior explicit authorization from RavenRootviel.
Architecture
Components and flows
The agents, services, verifiers, policy engines and evidence stores in this scenario, and how they connect. Drag to pan, scroll to zoom, and select any component for its role, inputs and outputs.
Agents
Agents and responsibilities
Each agent has a narrow responsibility, explicit inputs and outputs, and — crucially — its own authorization posture. Reasoning is never authorization.
Finding Aggregation Agent
Conceptual exampleCollects findings that were observed independently and normalises them into a common shape (what, where, when, source) without asserting any relationship between them.
- Inputs
- Independent findings (untrusted raw observations)
- Outputs
- Normalised finding set (no relationships asserted)
- Tools
- Finding normaliser (deterministic)
- Authorization
- None — read-only collection; it groups nothing and concludes nothing.
- Verification
- Each normalised finding keeps a pointer to its original source, so provenance survives normalisation and nothing is invented.
- Possible failures
- A finding with missing or malformed timestamps/source — kept but flagged low-confidence, never silently dropped.
Temporal Correlation Agent
Conceptual exampleOrders findings in time and surfaces candidate groupings — findings whose timing and locality are consistent with being part of one sequence. It proposes groupings; it does not claim they are causally linked.
- Inputs
- Normalised finding set
- Outputs
- Candidate groupings with temporal ordering (hypothesis-level)
- Tools
- Temporal windowing (synthetic, illustrative)
- Depends on
- aggregator
- Authorization
- None — produces candidate groupings, not verdicts.
- Verification
- Every grouping is labelled a correlation, with its time window stated, so a reader cannot mistake proximity for causation.
- Possible failures
- Coincidental co-occurrence grouped as if related — surfaced as a hypothesis for the verifier to test, not accepted as fact.
Hypothesis Agent
Conceptual exampleProposes a candidate attack chain that would explain a grouping: an ordered set of links, each with the dependency it assumes (step B required step A). The chain is explicitly a proposed explanation.
- Inputs
- Candidate grouping · Temporal ordering
- Outputs
- Candidate attack chain (ordered links + assumed dependencies)
- Tools
- Chain constructor (reasoning)
- Depends on
- correlator
- Authorization
- None — emits a hypothesis; it cannot mark any link corroborated.
- Verification
- Each link carries the assumption it depends on and is flagged UNCORROBORATED until the verifier finds independent support.
- Possible failures
- A plausible but wrong chain, or a chain with a missing link — both are expected and are what the corroboration stage exists to catch.
Corroboration Verifier
Tests each proposed link against evidence that is independent of the correlation that suggested it. A link is marked CORROBORATED only on independent support; otherwise it stays a HYPOTHESIS. The chain as a whole is only as strong as its weakest link.
- Inputs
- Candidate attack chain · Normalised findings with provenance
- Outputs
- Per-link verdict (CORROBORATED / HYPOTHESIS) · Corroboration record
- Tools
- Independence checker (deterministic)
- Depends on
- hypothesis · aggregator
- Authorization
- This is the corroboration boundary — it is what separates a told story from a supported one.
- Verification
- Corroboration requires evidence from a source independent of the one that produced the correlation; a verdict is reproducible from (link, independent evidence).
- Possible failures
- Mistaking a shared source for independent corroboration — guarded by the independence check, which rejects evidence tracing back to the same origin.
Impact Assessment Agent
Conceptual exampleEstimates the impact of the chain, carrying the corroboration status forward: impact of corroborated links is reported with stated assumptions; impact that rests on uncorroborated links is labelled an estimate with its uncertainty.
- Inputs
- Per-link verdicts · Candidate attack chain
- Outputs
- Impact estimate with explicit uncertainty + assumptions
- Tools
- Impact estimator (illustrative)
- Depends on
- corroborator
- Authorization
- None — reports an estimate; it does not upgrade a hypothesis to a fact.
- Verification
- Impact inherits the weakest corroboration status on its path, so an estimate can never read as more certain than the links it rests on.
- Possible failures
- Over-stating impact by treating an uncorroborated link as proven — prevented by carrying uncertainty through and labelling the figure an estimate.
Workflow
Processing and decisions
The ordered path from input to recorded decision.
- 1
Aggregate independent findings
Findings observed independently are normalised into a common shape, each keeping a pointer to its original source. No relationships between them are asserted yet.
- 2
Correlate in time
Findings are ordered and candidate groupings surfaced where timing and locality are consistent with one sequence. These are correlations, with their time window stated — not causal claims.
- 3
Construct a hypothesis
A candidate attack chain is proposed: ordered links, each with the dependency it assumes. Every link starts UNCORROBORATED.
- 4
Seek independent corroboration
Each link is tested against evidence from a source independent of the correlation that suggested it. A link becomes CORROBORATED only on such support; otherwise it stays a hypothesis.
- 5
Estimate impact with uncertainty
Impact is estimated carrying the corroboration status forward. Figures resting on uncorroborated links are labelled estimates with their uncertainty; nothing is reported as more certain than the links it rests on.
- 6
Record the chain honestly
The reconstructed chain is written with per-link verdicts, the assumptions made, and the impact estimate — so a reader can see exactly which parts are supported and which remain open.
Example execution
Walk through an illustrative trace
A synthetic, predefined sequence — step forward and back to see what each component does, the evidence it produces and the decisions taken. This is a conceptual/synthetic trace, not an executed experiment, and it cannot be run live in this preview.
Step 1 / 6 · Finding Aggregation Agent
Synthetic traceThree independent findings arrive
In a fictional internal service "orders-api", three findings are observed independently: (A) an auth anomaly for a service account, (B) an unusual child process on a worker, (C) a configuration change widening an egress rule. Each is normalised with its source pointer; no relationship is asserted.
▤ evidence: finding-set
Evidence
Evidence in this scenario
What is recorded, of what kind, with what integrity property and from where. Demonstrative data — not cryptographic evidence of a real system.
Normalised finding set
Observations (untrusted)Integrity: Each finding retains a pointer to its original source; no relationships asserted
Provenance: Finding Aggregation Agent over independent findings
Candidate temporal grouping
Correlation (hypothesis-level)Integrity: Time window stated; labelled correlation, not causation
Provenance: Temporal Correlation Agent
Reconstructed attack-chain record
Chain record with per-link verdicts (synthetic)Integrity: Per-link CORROBORATED/HYPOTHESIS status and impact uncertainty carried; demonstrative here
Provenance: Corroboration Verifier and Impact Assessment Agent
Security controls
Authorization, validation and containment
The mechanisms that make the scenario safe by design, independent of what any model concludes.
Hypothesis until corroborated
A reconstructed chain and each of its links start as a hypothesis and are only upgraded to CORROBORATED when independent evidence supports them.
Independent corroboration required
Corroboration must come from a source independent of the correlation that suggested the link; evidence tracing back to the same origin does not count.
Correlation is not causation
Temporal or spatial proximity produces a candidate grouping, never a causal conclusion; the time window and the correlation label travel with the finding.
Uncertainty carried into impact
Impact inherits the weakest corroboration status on its path and is labelled an estimate with explicit uncertainty whenever it rests on an uncorroborated link.
Failure conditions
What can go wrong — and the expected behaviour
Honest failure modes and the containment or recovery that keeps a failure from becoming an unauthorized effect.
Coincidental correlation
Findings co-occur in time by chance and are grouped as if they belong to one sequence.
Recovery
The grouping is only a hypothesis; the corroboration verifier demands independent evidence for each link, so an accidental grouping fails to be upgraded and is reported as unsupported.
Missing link
A link needed to complete the chain has no supporting evidence.
Recovery
The chain stays partial and that link remains a HYPOTHESIS; the record shows the gap explicitly rather than papering over it with a confident narrative.
Over-stated impact
Impact is reported as if an uncorroborated link were proven, inflating the apparent severity.
Recovery
Uncertainty is carried through from the per-link verdicts and the figure is labelled an estimate, so impact can never read as more certain than its weakest link.
Technical notes
Design considerations, limitations and references
- This is a conceptual architecture with a synthetic trace; no logs are queried, no model is executed, and the findings and service are fictional.
- There is no external or real target anywhere in this scenario — the service, accounts and events are invented to illustrate the reasoning, not any real incident.
- The discipline shown here is the same one applied across the lab: PROVEN, NOT PROVEN and UNKNOWN are kept distinct, and a corroborated claim holds only under its stated assumptions.
References
- MITRE ATT&CK
- MITRE ATLAS (Adversarial Threat Landscape for AI Systems)
- ROOTVIEL Knowledge Base — evidence scope: structural vs observed
Try this lab
Run it — coming soon
Interactive execution of this scenario is not part of the preview. When it is enabled, it will run on controlled, authorized scenarios only.
Live execution is not available in this preview. Access will require explicit authorization from RavenRootviel.
Authorized Access Only — Live Security Testing
Live security testing and agent execution require prior explicit authorization from RavenRootviel. The current preview provides educational content and non-operational demonstrations only. Browsing the educational content is public; operational use of the labs will require express authorization when it is enabled in a later phase. Access & use policy.