ⓘ Example data in this tool is AI-generated based on real-world threat reports. Quality improves with evolving AI capabilities. These examples illustrate the practical application of the TLCTC framework.
Attack Path Notation
Incident:

### Attack Path Detail Report

# | Cluster / Sphere | Description | Velocity | References | Risk Outcomes
--- | --- | --- | --- | --- | ---

### Configure Attack Step

1 Threat Classification
Step Type

V2.1 unresolved steps (whitepaper §11.5.4) carry no cluster and no DRE (R-UNRES-2, R-UNRES-5). Description is required as prose annotation (R-UNRES-8).

Primary Cluster *

Responsibility Sphere *
Unresolved-Step Metadata (v2.1)

R-UNRES-9 (Binary Rule): Candidates are informational only. If any listed candidate can be individually defended on the evidence, promote this to a classified step with `[conf=low]` instead.

Candidates (informational)
Estimated count (gap)
Domain Boundary Operator
Context
Source @
Target @
Transit Party (v2.1)

Intermediate carrier sphere(s) that relay the attack. Comma-separated for chained transit. R-TRANSIT-3: Vendor code on target device is NOT transit (e.g., Safari on victim's phone is attack surface, not carrier).

Intra-System Boundaries (v2.1)

Within-host boundary crossings (sandbox escape, privilege escalation, etc.). These are observability annotations — they do not change cluster classification (R-INTRA-7).

+ Parallel Action (#X + #Y)
Parallel Cluster

Concurrent exploitation of two distinct generic vulnerabilities at the same moment (e.g., #1 + #7 = function abuse and malware execution simultaneously). Must be a different cluster.

Description
2 Attack Velocity (Δt to next step)
Time Value
Unit
Velocity Class

VC-3/4 transitions typically outpace human response — automation required.

3 Operational References
MITRE ATT&CK
CVE/CWE
IoC / Asset
Evidence Reference
4 Step Annotations
Confidence
Stage
[inferred]
Timestamp (optional)
5 Risk Outcomes (Right side of Bow-Tie)

R-CRED Rule (Enforced): #4 Identity Theft represents credential use, not acquisition. DRE inputs are disabled for this cluster. DREs for credential theft belong on the acquisition step (#9, #2, #3, #5, #7, #8, or #10).

Data Risk Event (DRE)
C (Confidentiality) I (Integrity) A (Availability)
Business Impact

### Incident Metadata

Incident Title *
Sequence ID
Analyst
Organization
Threat Actor (if known)
Motivation
Sophistication
Description / Summary
ⓘThis is a demo / proof-of-concept for the TLCTC framework. All data is stored in your browser's local storage only — nothing is sent to a server. Use the export function to save your work if you are using real data.