Place an intrusion on the attack phases, then plan the courses of action
Paste the timeline of one intrusion - one event per line, a timestamp first - and the controls you had in place. Your browser places each event on the seven attack phases with its ATT&CK tactic, reads what was detected or blocked, how far the attacker got, the first detection and the dwell time, and flags the phases that ran unseen. Free, before you sign in, and nothing is uploaded. Then the map lane writes the phase-by-phase analysis with the gaps and the break point, and the courses-of-action lane fills the detect, deny, disrupt, degrade, deceive, destroy matrix and a control roadmap.
The organisations, hosts, accounts and addresses are invented. Two are maps (the freight company also carries its courses of action, one click after the map) and one is a plan; each comes with a saved model reply, so you can see the whole page without signing in or spending a credit.
What this does, and what it does not
The phase model is a simple idea that post-incident reviews tend to skip: an intrusion is a sequence of seven steps, and breaking any link stops it. So the useful questions after an incident are how far the adversary got, which phases they completed without anyone seeing them, where a detection fired and the attack went on anyway, and which control - at which phase - would have broken the chain earliest. The skill behind this page answers them in order: map every observed action to a phase, mark what was detected or stopped, name the gap for every phase that ran unseen, add ATT&CK detail, then plan the six courses of action per phase and a roadmap ordered by cost and effect. It also names the traps: attackers skip phases and loop back, reconnaissance and weaponization are mostly invisible to defenders, and an insider can start at the last phase.
The paid lanes see up to 120 events with the page's reading of each (the middle dropped past that, and the page says so), up to 40 controls and the page's flags. Your input stays in this browser unless you run a lane. Every reply is held to your input: quotes are checked word for word, every event and control id must be one of the page's, statuses must agree with the events, and no host, address, count or duration may be invented. It analyses the timeline as written, not the real incident, and it recommends defensive measures only. Derived from the agent skill @mukul975/analyzing-cyber-kill-chain (mukul975/anthropic-cybersecurity-skills, Apache-2.0: the seven phases, phase completion and detection points, the ATT&CK mapping, the six courses of action, the report structure and the common pitfalls). Sources are listed in llms.txt.
The seven phases follow the intrusion kill chain model published by Lockheed Martin researchers (Hutchins, Cloppert and Amin, 2011). Cyber Kill Chain is a registered trademark of Lockheed Martin Corporation. This tool is not affiliated with, sponsored by or endorsed by Lockheed Martin. ATT&CK is a trademark of The MITRE Corporation.