{ "note": "Real Linux firewall (iptables) enforcement of the real ACRS decisions, real TCP flows on one machine (loopback addresses). Detection is not timed; no EDR/NAC product.", "baseline": { "summary": { "malicious": 41, "c2_cut": 36, "spread_cut": 36, "service_lost": 37, "benign_service_lost": 1, "alert_to_c2_stopped_ms": { "median": 1.4, "max": 3.1, "min": 0.0 }, "alert_to_enforced_ms": { "median": 2.7, "max": 3.9 } }, "rows": [ { "scenario": "tier1_c2_hr", "host": "HR-APP-01", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.036, "alert_to_enforced_ms": 3.31, "alert_to_c2_stopped_ms": 2.92, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "tier0_dc_cred_dump", "host": "DC-01", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.031, "alert_to_enforced_ms": 3.86, "alert_to_c2_stopped_ms": 3.05, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "tier2_workstation", "host": "WS-HR-011", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.027, "alert_to_enforced_ms": 2.62, "alert_to_c2_stopped_ms": 1.37, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "ransomware_finance", "host": "WS-FIN-023", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.034, "alert_to_enforced_ms": 2.61, "alert_to_c2_stopped_ms": 1.37, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "ransomware_finance", "host": "WS-FIN-031", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.031, "alert_to_enforced_ms": 3.38, "alert_to_c2_stopped_ms": 3.08, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "ransomware_finance", "host": "WS-FIN-044", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.025, "alert_to_enforced_ms": 2.74, "alert_to_c2_stopped_ms": 1.87, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "erp_change_window_fp", "host": "ERP-PROD-01", "benign": true, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.023, "alert_to_enforced_ms": 3.0, "alert_to_c2_stopped_ms": 1.82, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "mri_non_isolatable", "host": "MRI-CTRL-02", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.025, "alert_to_enforced_ms": 2.79, "alert_to_c2_stopped_ms": 0.84, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "cloud_workload", "host": "API-GW-AWS-01", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.023, "alert_to_enforced_ms": 2.51, "alert_to_c2_stopped_ms": 1.32, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "ioc_return_hr", "host": "HR-APP-01", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.018, "alert_to_enforced_ms": 2.41, "alert_to_c2_stopped_ms": 0.96, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "unknown_host", "host": "10.77.7.7", "benign": false, "level": "MONITOR", "auto": false, "rules": 0, "decide_ms": 0.024, "alert_to_enforced_ms": 0.04, "alert_to_c2_stopped_ms": null, "c2_cut": false, "spread_cut": false, "service_still_reachable": true }, { "scenario": "dns_tunnel", "host": "WS-FIN-031", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.027, "alert_to_enforced_ms": 2.67, "alert_to_c2_stopped_ms": 0.0, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "beacon_hr_app2", "host": "HR-APP-02", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.019, "alert_to_enforced_ms": 3.71, "alert_to_c2_stopped_ms": 2.7, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "c2_build_server", "host": "DEV-BUILD-07", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.019, "alert_to_enforced_ms": 2.72, "alert_to_c2_stopped_ms": 1.45, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "vpn_gateway_c2", "host": "VPN-GW-01", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.018, "alert_to_enforced_ms": 3.2, "alert_to_c2_stopped_ms": 0.65, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "c2_ws_fin023", "host": "WS-FIN-023", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.026, "alert_to_enforced_ms": 3.53, "alert_to_c2_stopped_ms": 0.87, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "impossible_travel_hr", "host": "WS-HR-011", "benign": false, "level": "MONITOR", "auto": false, "rules": 0, "decide_ms": 0.022, "alert_to_enforced_ms": 0.03, "alert_to_c2_stopped_ms": null, "c2_cut": false, "spread_cut": false, "service_still_reachable": true }, { "scenario": "dc02_lsass_single", "host": "DC-02", "benign": false, "level": "MONITOR", "auto": false, "rules": 0, "decide_ms": 0.02, "alert_to_enforced_ms": 0.05, "alert_to_c2_stopped_ms": null, "c2_cut": false, "spread_cut": false, "service_still_reachable": true }, { "scenario": "pki_c2", "host": "PKI-CA-01", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.016, "alert_to_enforced_ms": 2.8, "alert_to_c2_stopped_ms": 0.0, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "travel_then_c2_ws044", "host": "WS-FIN-044", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.025, "alert_to_enforced_ms": 2.7, "alert_to_c2_stopped_ms": 1.27, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "ransomware_ws_hr", "host": "WS-HR-011", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.054, "alert_to_enforced_ms": 3.54, "alert_to_c2_stopped_ms": 1.06, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "ransomware_build", "host": "DEV-BUILD-07", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.028, "alert_to_enforced_ms": 2.64, "alert_to_c2_stopped_ms": 1.38, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "ransomware_erp_db", "host": "ERP-DB-01", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.018, "alert_to_enforced_ms": 2.41, "alert_to_c2_stopped_ms": 1.98, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "ransomware_dc02", "host": "DC-02", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.019, "alert_to_enforced_ms": 3.15, "alert_to_c2_stopped_ms": 2.51, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "k8s_node_miner", "host": "K8S-NODE-04", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.016, "alert_to_enforced_ms": 2.66, "alert_to_c2_stopped_ms": 1.02, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "k8s_cp_c2", "host": "K8S-CP-01", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.018, "alert_to_enforced_ms": 3.09, "alert_to_c2_stopped_ms": 1.27, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "aws_access_key_only", "host": "API-GW-AWS-01", "benign": false, "level": "MONITOR", "auto": false, "rules": 0, "decide_ms": 0.02, "alert_to_enforced_ms": 0.03, "alert_to_c2_stopped_ms": null, "c2_cut": false, "spread_cut": false, "service_still_reachable": true }, { "scenario": "aws_gw_exfil", "host": "API-GW-AWS-01", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.017, "alert_to_enforced_ms": 2.75, "alert_to_c2_stopped_ms": 2.16, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "phishing_macro_fin023", "host": "WS-FIN-023", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.019, "alert_to_enforced_ms": 2.66, "alert_to_c2_stopped_ms": 0.41, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "phishing_hta_fin044", "host": "WS-FIN-044", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.017, "alert_to_enforced_ms": 2.31, "alert_to_c2_stopped_ms": 1.69, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "outlook_cmd_fin031", "host": "WS-FIN-031", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.021, "alert_to_enforced_ms": 2.67, "alert_to_c2_stopped_ms": 0.56, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "vpn_credential_abuse", "host": "VPN-GW-01", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.017, "alert_to_enforced_ms": 2.69, "alert_to_c2_stopped_ms": 0.85, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "webshell_hr_gateway", "host": "HR-API-GW", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.021, "alert_to_enforced_ms": 3.26, "alert_to_c2_stopped_ms": 1.23, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "fin_api_rce", "host": "FIN-API-01", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.015, "alert_to_enforced_ms": 2.75, "alert_to_c2_stopped_ms": 1.61, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "aws_gw_node_exploit", "host": "API-GW-AWS-01", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.018, "alert_to_enforced_ms": 2.96, "alert_to_c2_stopped_ms": 1.47, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "hr_app2_webshell", "host": "HR-APP-02", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.02, "alert_to_enforced_ms": 2.52, "alert_to_c2_stopped_ms": 0.99, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "erp_web_exploit_cw", "host": "ERP-PROD-01", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.018, "alert_to_enforced_ms": 2.44, "alert_to_c2_stopped_ms": 1.34, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "erp_db_exfil", "host": "ERP-DB-01", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.024, "alert_to_enforced_ms": 3.1, "alert_to_c2_stopped_ms": 0.48, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "hr_db_exfil", "host": "HR-DB-01", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.019, "alert_to_enforced_ms": 2.5, "alert_to_c2_stopped_ms": 1.76, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "insider_dns_ws044", "host": "WS-FIN-044", "benign": false, "level": "MONITOR", "auto": false, "rules": 0, "decide_ms": 0.025, "alert_to_enforced_ms": 0.04, "alert_to_c2_stopped_ms": null, "c2_cut": false, "spread_cut": false, "service_still_reachable": true }, { "scenario": "response_memory_repeat", "host": "WS-FIN-031", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.052, "alert_to_enforced_ms": 2.73, "alert_to_c2_stopped_ms": 2.18, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "attribution_conflict", "host": "HR-APP-01", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.021, "alert_to_enforced_ms": 2.9, "alert_to_c2_stopped_ms": 1.41, "c2_cut": true, "spread_cut": true, "service_still_reachable": false } ] }, "acrs": { "summary": { "malicious": 41, "c2_cut": 36, "spread_cut": 30, "service_lost": 16, "benign_service_lost": 0, "alert_to_c2_stopped_ms": { "median": 1.4, "max": 2.8, "min": 0.0 }, "alert_to_enforced_ms": { "median": 3.3, "max": 7.0 } }, "rows": [ { "scenario": "tier1_c2_hr", "host": "HR-APP-01", "benign": false, "level": "SURGICAL", "auto": true, "rules": 1, "decide_ms": 0.051, "alert_to_enforced_ms": 2.75, "alert_to_c2_stopped_ms": 0.79, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "tier0_dc_cred_dump", "host": "DC-01", "benign": false, "level": "EMERGENCY_RESTRICT", "auto": true, "rules": 1, "decide_ms": 0.094, "alert_to_enforced_ms": 3.3, "alert_to_c2_stopped_ms": 2.83, "c2_cut": true, "spread_cut": false, "service_still_reachable": true }, { "scenario": "tier2_workstation", "host": "WS-HR-011", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.04, "alert_to_enforced_ms": 2.52, "alert_to_c2_stopped_ms": 1.03, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "ransomware_finance", "host": "WS-FIN-023", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.039, "alert_to_enforced_ms": 2.51, "alert_to_c2_stopped_ms": 1.52, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "ransomware_finance", "host": "WS-FIN-031", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.034, "alert_to_enforced_ms": 2.83, "alert_to_c2_stopped_ms": 0.0, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "ransomware_finance", "host": "WS-FIN-044", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.036, "alert_to_enforced_ms": 2.67, "alert_to_c2_stopped_ms": 1.28, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "erp_change_window_fp", "host": "ERP-PROD-01", "benign": true, "level": "RESTRICT", "auto": false, "rules": 0, "decide_ms": 0.034, "alert_to_enforced_ms": 0.04, "alert_to_c2_stopped_ms": null, "c2_cut": false, "spread_cut": false, "service_still_reachable": true }, { "scenario": "mri_non_isolatable", "host": "MRI-CTRL-02", "benign": false, "level": "COMPENSATING", "auto": true, "rules": 1, "decide_ms": 0.043, "alert_to_enforced_ms": 2.71, "alert_to_c2_stopped_ms": 0.77, "c2_cut": true, "spread_cut": false, "service_still_reachable": true }, { "scenario": "cloud_workload", "host": "API-GW-AWS-01", "benign": false, "level": "SURGICAL", "auto": true, "rules": 1, "decide_ms": 0.039, "alert_to_enforced_ms": 2.5, "alert_to_c2_stopped_ms": 1.74, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "ioc_return_hr", "host": "HR-APP-01", "benign": false, "level": "SURGICAL", "auto": true, "rules": 1, "decide_ms": 0.044, "alert_to_enforced_ms": 2.67, "alert_to_c2_stopped_ms": 1.17, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "unknown_host", "host": "10.77.7.7", "benign": false, "level": "RESTRICT", "auto": true, "rules": 1, "decide_ms": 0.032, "alert_to_enforced_ms": 3.39, "alert_to_c2_stopped_ms": 1.13, "c2_cut": true, "spread_cut": false, "service_still_reachable": true }, { "scenario": "dns_tunnel", "host": "WS-FIN-031", "benign": false, "level": "RESTRICT", "auto": true, "rules": 2, "decide_ms": 0.035, "alert_to_enforced_ms": 4.59, "alert_to_c2_stopped_ms": 1.19, "c2_cut": true, "spread_cut": true, "service_still_reachable": true }, { "scenario": "beacon_hr_app2", "host": "HR-APP-02", "benign": false, "level": "SURGICAL", "auto": true, "rules": 1, "decide_ms": 0.031, "alert_to_enforced_ms": 2.96, "alert_to_c2_stopped_ms": 2.6, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "c2_build_server", "host": "DEV-BUILD-07", "benign": false, "level": "RESTRICT", "auto": true, "rules": 2, "decide_ms": 0.035, "alert_to_enforced_ms": 5.09, "alert_to_c2_stopped_ms": 0.59, "c2_cut": true, "spread_cut": true, "service_still_reachable": true }, { "scenario": "vpn_gateway_c2", "host": "VPN-GW-01", "benign": false, "level": "RESTRICT", "auto": true, "rules": 2, "decide_ms": 0.034, "alert_to_enforced_ms": 7.03, "alert_to_c2_stopped_ms": 1.48, "c2_cut": true, "spread_cut": true, "service_still_reachable": true }, { "scenario": "c2_ws_fin023", "host": "WS-FIN-023", "benign": false, "level": "RESTRICT", "auto": true, "rules": 2, "decide_ms": 0.042, "alert_to_enforced_ms": 6.96, "alert_to_c2_stopped_ms": 2.74, "c2_cut": true, "spread_cut": true, "service_still_reachable": true }, { "scenario": "impossible_travel_hr", "host": "WS-HR-011", "benign": false, "level": "MONITOR", "auto": false, "rules": 0, "decide_ms": 0.037, "alert_to_enforced_ms": 0.05, "alert_to_c2_stopped_ms": null, "c2_cut": false, "spread_cut": false, "service_still_reachable": true }, { "scenario": "dc02_lsass_single", "host": "DC-02", "benign": false, "level": "MONITOR", "auto": false, "rules": 0, "decide_ms": 0.025, "alert_to_enforced_ms": 0.03, "alert_to_c2_stopped_ms": null, "c2_cut": false, "spread_cut": false, "service_still_reachable": true }, { "scenario": "pki_c2", "host": "PKI-CA-01", "benign": false, "level": "EMERGENCY_RESTRICT", "auto": true, "rules": 1, "decide_ms": 0.039, "alert_to_enforced_ms": 4.91, "alert_to_c2_stopped_ms": 1.25, "c2_cut": true, "spread_cut": false, "service_still_reachable": true }, { "scenario": "travel_then_c2_ws044", "host": "WS-FIN-044", "benign": false, "level": "RESTRICT", "auto": true, "rules": 2, "decide_ms": 0.038, "alert_to_enforced_ms": 5.11, "alert_to_c2_stopped_ms": 2.1, "c2_cut": true, "spread_cut": true, "service_still_reachable": true }, { "scenario": "ransomware_ws_hr", "host": "WS-HR-011", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.03, "alert_to_enforced_ms": 3.24, "alert_to_c2_stopped_ms": 2.56, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "ransomware_build", "host": "DEV-BUILD-07", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.028, "alert_to_enforced_ms": 2.41, "alert_to_c2_stopped_ms": 0.88, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "ransomware_erp_db", "host": "ERP-DB-01", "benign": false, "level": "SURGICAL", "auto": true, "rules": 1, "decide_ms": 0.03, "alert_to_enforced_ms": 3.07, "alert_to_c2_stopped_ms": 2.66, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "ransomware_dc02", "host": "DC-02", "benign": false, "level": "EMERGENCY_RESTRICT", "auto": true, "rules": 1, "decide_ms": 0.03, "alert_to_enforced_ms": 2.54, "alert_to_c2_stopped_ms": 1.47, "c2_cut": true, "spread_cut": false, "service_still_reachable": true }, { "scenario": "k8s_node_miner", "host": "K8S-NODE-04", "benign": false, "level": "RESTRICT", "auto": true, "rules": 2, "decide_ms": 0.032, "alert_to_enforced_ms": 6.1, "alert_to_c2_stopped_ms": 1.14, "c2_cut": true, "spread_cut": true, "service_still_reachable": true }, { "scenario": "k8s_cp_c2", "host": "K8S-CP-01", "benign": false, "level": "EMERGENCY_RESTRICT", "auto": true, "rules": 1, "decide_ms": 0.038, "alert_to_enforced_ms": 2.39, "alert_to_c2_stopped_ms": 0.75, "c2_cut": true, "spread_cut": false, "service_still_reachable": true }, { "scenario": "aws_access_key_only", "host": "API-GW-AWS-01", "benign": false, "level": "MONITOR", "auto": false, "rules": 0, "decide_ms": 0.033, "alert_to_enforced_ms": 0.04, "alert_to_c2_stopped_ms": null, "c2_cut": false, "spread_cut": false, "service_still_reachable": true }, { "scenario": "aws_gw_exfil", "host": "API-GW-AWS-01", "benign": false, "level": "RESTRICT", "auto": true, "rules": 2, "decide_ms": 0.034, "alert_to_enforced_ms": 4.47, "alert_to_c2_stopped_ms": 2.17, "c2_cut": true, "spread_cut": true, "service_still_reachable": true }, { "scenario": "phishing_macro_fin023", "host": "WS-FIN-023", "benign": false, "level": "RESTRICT", "auto": true, "rules": 2, "decide_ms": 0.029, "alert_to_enforced_ms": 4.95, "alert_to_c2_stopped_ms": 0.43, "c2_cut": true, "spread_cut": true, "service_still_reachable": true }, { "scenario": "phishing_hta_fin044", "host": "WS-FIN-044", "benign": false, "level": "RESTRICT", "auto": true, "rules": 2, "decide_ms": 0.044, "alert_to_enforced_ms": 4.24, "alert_to_c2_stopped_ms": 0.87, "c2_cut": true, "spread_cut": true, "service_still_reachable": true }, { "scenario": "outlook_cmd_fin031", "host": "WS-FIN-031", "benign": false, "level": "FULL_ISOLATION", "auto": true, "rules": 1, "decide_ms": 0.03, "alert_to_enforced_ms": 2.48, "alert_to_c2_stopped_ms": 2.03, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "vpn_credential_abuse", "host": "VPN-GW-01", "benign": false, "level": "RESTRICT", "auto": false, "rules": 0, "decide_ms": 0.028, "alert_to_enforced_ms": 0.04, "alert_to_c2_stopped_ms": null, "c2_cut": false, "spread_cut": false, "service_still_reachable": true }, { "scenario": "webshell_hr_gateway", "host": "HR-API-GW", "benign": false, "level": "SURGICAL", "auto": true, "rules": 1, "decide_ms": 0.031, "alert_to_enforced_ms": 3.52, "alert_to_c2_stopped_ms": 1.28, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "fin_api_rce", "host": "FIN-API-01", "benign": false, "level": "SURGICAL", "auto": true, "rules": 1, "decide_ms": 0.045, "alert_to_enforced_ms": 3.39, "alert_to_c2_stopped_ms": 2.62, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "aws_gw_node_exploit", "host": "API-GW-AWS-01", "benign": false, "level": "SURGICAL", "auto": true, "rules": 1, "decide_ms": 0.057, "alert_to_enforced_ms": 3.24, "alert_to_c2_stopped_ms": 0.77, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "hr_app2_webshell", "host": "HR-APP-02", "benign": false, "level": "SURGICAL", "auto": true, "rules": 1, "decide_ms": 0.031, "alert_to_enforced_ms": 2.82, "alert_to_c2_stopped_ms": 1.59, "c2_cut": true, "spread_cut": true, "service_still_reachable": false }, { "scenario": "erp_web_exploit_cw", "host": "ERP-PROD-01", "benign": false, "level": "RESTRICT", "auto": true, "rules": 2, "decide_ms": 0.03, "alert_to_enforced_ms": 5.95, "alert_to_c2_stopped_ms": 0.99, "c2_cut": true, "spread_cut": true, "service_still_reachable": true }, { "scenario": "erp_db_exfil", "host": "ERP-DB-01", "benign": false, "level": "RESTRICT", "auto": true, "rules": 2, "decide_ms": 0.039, "alert_to_enforced_ms": 4.8, "alert_to_c2_stopped_ms": 1.69, "c2_cut": true, "spread_cut": true, "service_still_reachable": true }, { "scenario": "hr_db_exfil", "host": "HR-DB-01", "benign": false, "level": "RESTRICT", "auto": true, "rules": 2, "decide_ms": 0.029, "alert_to_enforced_ms": 4.56, "alert_to_c2_stopped_ms": 1.91, "c2_cut": true, "spread_cut": true, "service_still_reachable": true }, { "scenario": "insider_dns_ws044", "host": "WS-FIN-044", "benign": false, "level": "MONITOR", "auto": false, "rules": 0, "decide_ms": 0.032, "alert_to_enforced_ms": 0.04, "alert_to_c2_stopped_ms": null, "c2_cut": false, "spread_cut": false, "service_still_reachable": true }, { "scenario": "response_memory_repeat", "host": "WS-FIN-031", "benign": false, "level": "RESTRICT", "auto": true, "rules": 2, "decide_ms": 0.042, "alert_to_enforced_ms": 6.47, "alert_to_c2_stopped_ms": 1.65, "c2_cut": true, "spread_cut": true, "service_still_reachable": true }, { "scenario": "attribution_conflict", "host": "HR-APP-01", "benign": false, "level": "RESTRICT", "auto": true, "rules": 2, "decide_ms": 0.038, "alert_to_enforced_ms": 4.72, "alert_to_c2_stopped_ms": 2.1, "c2_cut": true, "spread_cut": true, "service_still_reachable": true } ] } }