Anatomy and engagement assets
The Surface combines exposure, engagement, evidence, intelligence and operations.
This map shows the roles inside a Surface and the direction of causal flow. Each component has a job; together they turn selected hostile interaction into material an analyst can use.
Different targets answer different questions.
The adversary encounters a target, not the platform. What that target can be is what determines how much becomes defensive knowledge.
Role — economical, protocol-aware early signal.
The adversary encounters a service or appliance interaction able to receive authentication and protocol behavior, with no full operating-system session behind it.
The defender receives
- credentials and authentication material presented
- interaction and protocol sequence
- selected tool or client characteristics
- associated timing and source context
Boundary — no full operating-system session.
Role — deeper observation of post-access behavior.
The adversary encounters a real operating-system target with a credible synthetic context.
The defender receives, where applicable
- terminal session record and replay
- commands, including non-interactive execution
- files transferred and their hashes
- tools deployed and client fingerprints
- attempted tunnels or pivot indicators
- related network activity and artifacts
Boundary — available claims refer to controlled deployments; they do not generalize to every operating system or protocol.
Breadth for signal. Depth for behavior.
The lower-cost layers create wider visibility and early warning. Live Hosts are reserved for questions that require deeper observation of what an actor does after access. A Surface can combine these layers according to the mission and operating constraints.
| Depth | HIIH asset | What the adversary encounters | Current status |
|---|---|---|---|
| Apparent presence | Ghost Node | an apparent network presence and discovery touch | deployment-specific |
| Protocol & authentication | Contact Point | a protocol-aware service or appliance interaction | available today |
| Full OS interaction | Live Host | a real operating-system session | available today |