Threat Actor Attribution

What it solves

A SOC analyst who gets a malicious verdict from an indicator workflow cannot ask "who, and what do they do" without writing Cypher by hand, and an intel analyst starting from an actor name has no graph-native way in at all — the retired actor-ttp workflow left this pivot with no direct equivalent.

Why

1. 01Threat tags. A tag is a lead, not a named actor — this graph has no tag-to-actor edge (see below).
2. 02Direct attribution. ATTRIBUTED_TO is the one edge this graph carries as evidence, not a lead.
3. 03The attributed actor's techniques. Names what the attributed actor actually does, not just who they are.
4. 04The attributed actor's tactics. An actor has no direct tactic edge — every tactic here is derived from a technique it uses.
5. 05Indicators sharing a tag. A shared tag is a cluster lead — checked against the threat feeds next, not assumed malicious.
6. 06Threat check on tag-sharing siblings. A coverage-qualified band, so a sibling with no feed history never reads as clean.
7. 07Resolve by exact name. Actor names are exact and case-sensitive — tried before any alias or prefix candidate.
8. 08Resolve by alias. Only runs when the exact name did not resolve — a known alias (case-sensitive) still finds the actor.
9. 09Similar actor names. An indexed prefix scan — candidates to try next, never auto-resolved as a match.
10. 10The actor's techniques. Both duplicate actor nodes are queried — a technique either twin uses still counts.
11. 11The actor's tactics. The graph’s own current ATT&CK tactic ids — never a hard-coded tactic list.
12. 12The actor's directly-attributed infrastructure. Bounded to 200 — the same ATTRIBUTED_TO edge the discovery form itself reads, not a malware-family pivot (see header).
13. 13Threat check on the attributed infrastructure. A coverage-qualified band beside a named actor, not an unqualified "malicious" guess.
14. 14ASN concentration. A shared ASN across several attributed IPs is itself an infrastructure signal.

What this cost

14 named steps across the threat-intel layer. The runner reports what each step returned, row by row, so the evidence and what it took to get it arrive together rather than as one number at the end.

How it uses the graph

Traverses the threat-intel layer of the graph, in 14 steps: