TONK · Threat Observation & Network Kill-chain
ATT&CK-mapped hunt references, intel and attribution, and purple-team validation. Every kit keys on the same technique IDs, so you can move between them without translating.
Hunt
Daily-ops detection workbenches
Network detection across the ATT&CK matrix. Kibana, Arkime and Suricata queries with APT correlation, OSINT notes, and air-gapped vs connected tripwire framing.
▸ open referenceHost indicators and detection syntax across the attack lifecycle, Windows and Linux, with APT correlation and OSINT notes.
▸ open referencePlan & attribute
Where to start, and who it looks like
Prioritized hunt sequences by threat actor, environment and architecture. Start here when intel drops an actor name.
▸ open playbooksOpen-source reporting every 6 hours, matched to TONK actors, techniques, tools and CVEs, with a coverage gap queue.
▸ open intelRanks likely actors from the indicators you starred in NET and HOST. Save and restore hunt state across sessions and machines.
▸ open attributionValidate & train
Prove the detections fire
Adversary-emulation triggers paired with the telemetry each should produce, with per-technique validation outcomes. Same ATT&CK IDs as NET and HOST for 1:1 cross-reference.
▸ open purpleScenario simulator. Work realistic network evidence, spot the anomaly, check your read against the explanation. Easy, medium and hard.
▸ open detect