Anatomy of a Finding
A stable object for adversary activity.
Instead of asking analysts to reconstruct meaning from disconnected logs, HIIH represents material activity as a structured Finding. The Finding records what was observed, what is assessed, how confident that assessment is, why it matters to the mission, what supporting material is related, and what action may follow.
The block below shows a public explanatory model of a Finding — not a verbatim dump of the internal schema.
finding_id: HIIH-F-2026-0017
family: access | exposure | engagement
summary: concise operational statement
observed:
- directly recorded fact
assessed:
- interpretation, explicitly labeled
confidence: low | medium | high
relevance: internet-wide | sector-relevant | profile-specific | ...
supporting_material:
- observations
- sessions
- artifacts
recommended_action:
- operational next step
status: new | reviewed | closed
The same structured object lets a SOC analyst triage with context, a CTI analyst relate behavior to a campaign, a detection engineer derive searches, an MSSP explain the event to its client, and an executive receive a concise briefing grounded in the same activity. HIIH does not claim that all of those representations are automatically generated today.
What the analyst needs to know — and what the system does not claim to know.
- Observed activity
- A recurring client fingerprint attempted a previously observed credential set against the selected profile, then ended the session without post-authentication activity
- Mission relevance
- Sector-relevant
- Why it matters
- Behavior is consistent with access validation rather than interactive exploitation
- Supporting material
- 24 authentication attempts over 18 minutes · repeated client characteristics from three source addresses · fixed credential order
- Suggested action
- Review exposed credentials and tune identity and edge monitoring for the observed pattern
- Delivery
- Surface Console · MCP · API — pull-based
A Finding is built from seven regions the analyst can inspect.
| Region | Contents |
|---|---|
| Identity | Finding ID, creation time, Surface / mission reference, current review status — a stable reference across the Surface Console and pull paths. |
| Summary | A one- or two-sentence operational statement. Never “malicious actor detected”; always what was observed and what it means. |
| Observed facts | Only directly recorded statements: attempt counts, recurring characteristics, reused credentials, transferred binaries, attempted tunnels. |
| Assessment | Explicit interpretation, labeled as such: consistent with access validation, one toolchain behind several origins, persistence preparation. |
| Confidence | High, Medium or Low — the strength of support for the assessment, not severity. |
| Relevance | A mission-relative statement, from Internet-wide to confirmed-targeted or internal post-compromise signal. |
| Supporting material & action | Related observations, session or replay, artifacts and hashes, network context, related Findings, and a recommended next step. |
Different depths of engagement produce different classes of knowledge.
Findings about authentication material, credentials, keys, tokens or access-validation behavior presented to the Surface.
Value — identify active credential testing, separate broad automation from repeated validation, enrich identity and response workflows.
Findings about the services, protocol behaviors, exploit attempts, payloads or access paths tested against the selected Surface exposure.
Value — understand pressure on selected edge technologies, prioritize hardening, identify recurring campaigns and tooling.
Findings about post-access activity on a controlled Live Host: commands, files, tools, persistence, pivot attempts and related behavior.
Value — understand operator workflow, obtain artifacts before they touch production, derive detection and hunting material.
Facts remain facts. Assessment remains assessment.
HIIH makes uncertainty inspectable rather than hiding it. A Finding is more credible when it states what the Surface directly recorded, what the analyst or system assesses, how confident that assessment is, and what remains unknown.
| Observed | Assessed | Not established |
|---|---|---|
| Same client characteristics in four sessions | Activity likely used one repeatable toolchain | Named actor identity |
| Credential set reused in a fixed order | Behavior consistent with access validation | Credential validity against production |
| Binary transferred and executed | Tooling appears intended for persistence | Full campaign objective |
| Internal non-public target contacted | Unauthorized presence is highly likely | Initial compromise path |
This distinction answers the questions that matter: Is this just Internet noise? How do you know it was targeted? Are you attributing an actor? Is this evidence or analysis? Observations and assessment are never mixed in a single list.
The same activity can mean different things in different deployments.
Confidence describes support for the assessment — not severity, and not the probability of future compromise. Relevance describes why the activity matters to the deployment. The two are kept separate, and both are separate again from severity.
| Confidence | Meaning |
|---|---|
| High | Assessment closely supported by direct observations. |
| Medium | Plausible interpretation with material support and remaining ambiguity. |
| Low | Early hypothesis requiring additional observation. |
| Relevance | Meaning |
|---|---|
| Internet-wide | Broad activity with little mission specificity. |
| Regional | Activity concentrated in a selected geography. |
| Sector-relevant | Technology, credential or behavior relevant to the sector. |
| Profile-specific | Activity aligned with the Surface persona or exposure profile. |
| Customer-directed | Evidence links the activity to the organization or mission. |
| Confirmed-targeted | Direct evidence supports deliberate targeting. |
| Internal post-compromise signal | Interaction with a non-public target where no legitimate contact is expected. |
Open the material behind the Finding.
Supporting evidence is the operational material linked to a Finding: related observations, session records, commands, authentication activity, files, hashes, fingerprints, network context or other artifacts available for that engagement.