The delivery paths
The full context when an alert is not enough.
The Surface Console is the place to reconstruct what the adversary did inside the controlled environment. It is useful for deep analysis, evidence review and briefing preparation. Day-to-day alerting and case management can remain in the customer’s existing tools.
Where the deployment allows, the Console supports:
- Finding list and detail;
- engagement or session timelines;
- related observations and artifact references;
- available session replay;
- adversary or profile context;
- query or investigation access;
- links between Findings and underlying activity.
Pull Findings into your own integrations.
The API gives authorized integrations programmatic pull access to Findings and indicators, scoped per deployment. Your SIEM, CTI platform or internal tooling retrieves on its own schedule, and each Finding keeps its stable identity. HIIH does not push into your environment.
Pull structured HIIH indicators into your CTI platform and SIEM.
A TAXII 2.1 path, exposing structured Findings and indicators as STIX 2.1 objects, is available by engagement. Where it is set up, your CTI platform, SIEM or threat-intelligence pipeline pulls from the collection on your own schedule — HIIH does not push into your environment. Each object carries the stable Finding identity and enough operational context to triage, correlate, ticket or escalate. Scope, collection and access model are defined with the engagement.
The object below is illustrative: the address comes from a range reserved for documentation (RFC 5737).
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--3f1c2a9e-8b4d-4e0a-9c7f-2d5e6b1a0c47",
"created": "2026-07-12T04:03:00.000Z",
"modified": "2026-07-12T04:03:00.000Z",
"name": "HIIH-F-2026-0017",
"indicator_types": ["malicious-activity"],
"labels": ["access", "credential-validation"],
"confidence": 85,
"pattern": "[ipv4-addr:value = '203.0.113.17']",
"pattern_type": "stix",
"valid_from": "2026-07-12T04:03:00Z",
"external_references": [
{ "source_name": "HIIH", "external_id": "HIIH-F-2026-0017" }
]
}
What the customer can do — pull indicators into a CTI platform or SIEM on a schedule; correlate the source or artifact with production telemetry; open or enrich a SOC case; route by severity or family; trace each object back to the Finding it came from; measure HIIH-originated cases separately from generic perimeter noise.
Make selected HIIH context available to authorized tools.
HIIH exposes a Model Context Protocol (MCP) path through which authorized analyst tools or AI-assisted tools can retrieve selected Findings and investigation context. It lets an approved tool query selected HIIH objects, investigate an indicator or Finding without exporting the entire evidence store, and support analyst-led workflows where the client’s environment permits — while preserving the Finding identity across the path.
MCP complements analyst judgment; it does not replace it, and does not imply unrestricted model access to the Evidence Plane.
Keep a stable reference as the signal moves.
Across the pull paths — Console, API and MCP, and STIX 2.1 over TAXII 2.1 by engagement — HIIH preserves the Finding identity so analysts can refer back to the same structured object. The SOC and the HIIH analyst can discuss the same object; investigation notes can cite a stable Finding identity; a partner can discuss the same activity with a client; and downstream correlation can distinguish updates from unrelated alerts.
Across the pull paths. The TAXII object applies where that path is set up by engagement.