Intrusion Phase Map

Paste one intrusion's timeline and your controls: the browser places every event on seven attack phases (reconnaissance through actions on objectives) with its ATT&CK tactic, reads detections, the furthest phase, the first detection and dwell time, and flags phases that ran unseen. Then a map lane writes the phase-by-phase analysis with gaps and the break point, and a courses-of-action lane fills the detect/deny/disrupt/degrade/deceive/destroy matrix and a control roadmap. Derived from the agent skill @mukul975/analyzing-cyber-kill-chain (mukul975/anthropic-cybersecurity-skills, Apache-2.0). Not affiliated with Lockheed Martin.