Caseassembly
Cluster loose signals into one coherent session case with an evidence chain and a timeline.
A score on its own is not an explanation. L3 is the bridge between low-level telemetry and everything downstream that has to be read by a human: it clusters the individual signals into a session-level case, keeps the evidence chain that produced each one, builds the ATT&CK technique set, and maintains a confidence value and a timeline.
This is what makes the console's attack story possible without reconstructing anything after the fact. The case is assembled while the session is live, so the timeline you replay is the timeline that was recorded.
- Fired heuristics
- Raw observations
- Score history
- Session case
- Evidence chain
- ATT&CK technique set
- Confidence
Rules this layer holds to
Each of these is written down because relaxing it would be locally convenient and globally wrong.
Confidence here is confidence about behaviour within the system. It says nothing about who is behind the connection.