# Intrusion Phase Map > Paste the timeline of one intrusion - one event per line with a timestamp, or a table with a time and an event column - and the list of defensive controls you had, and see how far the adversary got across the seven attack phases. The browser places each event on a phase with its ATT&CK tactic, reads what was detected, blocked or missed, the furthest phase, the first detection and the dwell time, maps every control to phases and courses of action, and flags the phases that ran unseen, for free. Then a map lane writes the phase-by-phase analysis - status, tactics, a word-for-word quote, the detection and the defensive gap, the verdict and the earliest break point - and a courses-of-action lane fills the detect, deny, disrupt, degrade, deceive and destroy matrix for every phase and a prioritised control roadmap. URL: https://intrusion-phase-map.skillsafe.ai/ API tutorial: https://intrusion-phase-map.skillsafe.ai/api.html ## Who it is for Incident responders, SOC analysts, security engineers and IT leads who have the timeline of an intrusion (a post-incident report, an IR scratchpad, a SIEM export) and want to know which phases the attacker completed without being seen, where a detection fired and the attack went on anyway, and which control at which phase would have broken the chain earliest. ## The free scan (in the browser, no model) - The timeline as plain lines (a leading timestamp: 2026-09-09 08:14, 2026-09-09T08:14Z, 14 Sep 2026 08:14, Sep 14 08:14, or 08:14 under a date-only line) or as a pipe, tab or CSV table with a Time and an Event column; bullets, numbering, # headings and table rulers are handled. - Each event's intrusion phase or phases by keyword (reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives), its ATT&CK enterprise tactics (TA0001-TA0043), and whether its text says it was detected, blocked or missed (negations such as "no alert" or "was not blocked" read as missed). - Indicators: IPv4 addresses, domains, MD5/SHA-1/SHA-256 hashes, CVE ids and ATT&CK technique ids, with defanged forms (203.0.113[.]7, hxxps) refanged. - Per phase: no evidence, not reached, completed (detected or not), stopped here or still open; the furthest phase; a verdict (objectives reached when collection, exfiltration or impact happened; stopped early or late; still open); the first detection in time order; the dwell time from the first event inside the network to the first detection. - Each control's phases and course-of-action kinds, in place or absent/partial, and the coverage grid per phase and COA. - Flags KC-01..KC-14: objectives reached or actions begun; no detection at all; a late first detection; dwell time over a day (high over a week); an alert that fired while the attack went on; a missing link between phases; the chain looping back; a phase passed undetected despite a listed control; a phase passed undetected with no control; missing or out-of-order timestamps; unclassified events; no evidence for reconnaissance or weaponization; an insider signal; no controls listed. Exports: the scan as Markdown and the events as CSV. ## The paid lanes (one system prompt, routed on `task`) - `map`: the seven phases in order, each with a status, its events, ATT&CK tactics that fit the phase, techniques only where an event plainly shows one, a word-for-word quote, what detected or stopped it and the defensive gap; every event placed exactly once or listed as unplaced (the defender's own actions); the verdict, the furthest phase, the first detection, every page flag confirmed or disputed, the earliest realistic break point and the intrusion told in order. - `coa`: the courses-of-action matrix - detect, deny, disrupt, degrade, deceive, destroy for each phase, marking controls already in place by id - and a roadmap of 3-12 actions sorted now, next quarter, later, with cost and effect, every phase passed unseen answered by a detect or deny action. Destroy means a takedown, a sinkhole or a referral, never an attack. A map hands over to it with one button. Every reply is checked against the input: phases in order; every event placed once; statuses consistent with the events and the furthest phase; the verdict the phases allow; tactics fitting their phase; quotes word for word from the phase's events; real event and control ids; no host, address, count or duration the input does not contain; no hack-back. It analyses the timeline as written. ## Input and output Run input (all strings): `task` ("map" or "coa"), `incident`, `timeline` (lines as "E1: ..."), `controls` (lines as "C1: ..."), `facts` (the page's reading as a JSON string), optional `question`, optional `map_handoff` (coa only) and `retry_note`. The reply is one JSON object per the lane's contract; the API tutorial documents both with worked examples. ## Source - @mukul975/analyzing-cyber-kill-chain - https://skillsafe.ai/skill/@mukul975/analyzing-cyber-kill-chain - mukul975/anthropic-cybersecurity-skills, Apache-2.0: the seven attack phases and their indicators, phase completion and detection points, the mapping to ATT&CK tactics, the six courses of action (detect, deny, disrupt, degrade, deceive, destroy), the report structure and the common pitfalls (non-linear progression, invisible early phases, insider threats, phases versus tactics). - The seven phases follow the intrusion kill chain model published by Lockheed Martin researchers (Hutchins, Cloppert and Amin, 2011). Cyber Kill Chain is a registered trademark of Lockheed Martin Corporation; this tool is not affiliated with, sponsored by or endorsed by Lockheed Martin. - Built and hosted on SkillSafe (https://skillsafe.ai/). Runs on gpt-terra.