D3 Security · Security Operations Glossary

What Is Attack Path Discovery?

A standalone glossary definition, part of the D3 Security Operations Glossary.

Definition

Attack Path Discovery is D3 Morpheus‘s proprietary autonomous investigation engine. It performs L2-depth investigation on every security alert, tracing threats horizontally across 800+ connected tools and vertically through 90 days of historical telemetry, reconstructing the complete attack path before any analyst intervention.

What Attack Path Discovery Does

Attack Path Discovery, D3’s investigation engine, traces threats horizontally across identities, endpoints, cloud, and email infrastructure, and vertically through 90 days of telemetry, reconstructing the full attack timeline before your analyst opens the case.

APD assembles the story behind every alert. It maps blast radius. It drafts the remediation. Morpheus does the legwork. Your analyst does the analysis.

An alert names one event. APD reconstructs what came before that event and what it touched afterward. The analyst reviews the finished path and decides what to do about it.

Two Hunting Dimensions

Horizontal investigation, also called East-West tracing, queries multiple security tools simultaneously at the same point in time. For a single suspicious sign-in alert, APD returns parallel evidence from your identity provider, EDR, cloud security platform, and email security tool in one consolidated view. The analyst reads that one view and skips four console logins.

That reach spans any of Morpheus’s 800+ bidirectional integrations, including SIEM, EDR, identity providers, cloud security platforms, email security, and vulnerability scanners. The specific tools queried depend on which integrations are active in your environment.

Vertical investigation, also called North-South tracing, reaches backwards through historical telemetry to determine whether the current alert is a one-off or part of a pattern. APD reaches back 90 days by default; configurable up to 365 days. The precursor events that led to the alert surface inside that window, so a lateral movement detection can be traced to the initial access that started it.

The pivoting work that used to consume an analyst afternoon is finished before the analyst opens the case. What arrives is a reconstructed path, the evidence behind each hop, and the queries that produced that evidence.

Also see:
Autonomous investigation
Query transparency

What an APD Investigation Produces

Every alert that enters Morpheus receives a complete investigation package. The analyst opens the case and finds:

A ranked attack timeline. One chronologically ordered narrative of every correlated event, each tagged by data source, timestamp, and confidence weight.
The data sources APD reached. Every integration queried, with response time and result set size. If a tool returned no relevant data, that fact is visible.
The attack path graph. A visual representation of correlated entities, including users, hosts, files, and domains, connected by relationship edges.
The MITRE ATT&CK mapping. Every event mapped to its ATT&CK technique ID and tactic.
The recommended next action. A deterministic step or Agentic Task option, ranked by confidence and tagged with its command-risk tier.
The audit trail. Every reasoning step, every tool call, every source consulted, in a single document.

Every item on that list arrives assembled. APD finishes the log review, the correlation, and the console pivoting before the analyst opens the case, so the analyst starts from a reconstructed path with the evidence attached to every step.

Vulnerability Chainability

Attack Path Discovery also runs on vulnerability findings. The same engine that traces threats across your security stack maps chainable exploit paths across multiple findings that individually score below threshold but together form a critical attack path.

A CVSS 5.3 information leak plus a CVSS 6.1 privilege escalation plus a CVSS 4.8 sandbox escape individually pass any static filter. Together, they are remote code execution. Static prioritization cannot detect this. Attack Path Discovery does, on every finding, every time.

Also see:
SOAR Ceiling
Agentic SOC

The Query-Level Audit Trail

APD shows its work. Every query listed in an investigation summary corresponds to a query that actually ran against the customer’s tools. A large US-based MSSP verified this in 2026 with a query-by-query audit, and the queries executed matched the queries listed, a 100% match. When Morpheus is uncertain, it defers to a human.

That property is what makes autonomy governable. Every reasoning step, every tool call, every source consulted, and every confidence weight lands in one exportable audit trail per investigation. The investigation record becomes evidence auditors and regulators can check, and an analyst can reopen any step to see the raw result behind a conclusion. Customer-written investigation guidelines are applied to those queries as enforceable policy.

What APD 2.0 Does When the Data Breaks

The same MSSP designed and ran five adversarial scenarios in its own multi-tenant SOC, built on Microsoft Sentinel, CrowdStrike, and Okta. It wrote its own pass and fail criteria, then broke things on purpose.

With Sentinel authentication deliberately broken, APD 2.0 identified a permanent authentication issue and stated that its verdict could not be confirmed. With the CrowdStrike agent taken offline, it recognized a platform-wide issue and flagged that results could not be fully confirmed. When Okta API drift degraded identity telemetry, it flagged that results could not be fully confirmed and routed the issue details to SOC analysts. After the fix, the queries were rerun and Morpheus reached the correct conclusion.

The cross-tenant probes tested the failure that would end a multi-tenant security business. An investigation guideline requiring the customer name in every Sentinel search was honored in 100% of queries. Scoping applies at the field level of the SIEM data, so other tenants’ results are excluded by construction, and the customer found no case in which an investigation could reach another tenant’s data. When Morpheus is uncertain, it defers to a human.

In the customer’s words:

“We did not observe any issues during the test. In all error scenarios, the investigation verdict was correct. Morpheus was able to avoid false negatives. Morpheus was able to provide the correct response from APD. More importantly, Morpheus failed to a human analyst when it had incomplete information.”

Security engineering team, large US-based MSSP

APD 2.0 passed all five scenarios with no critical findings, producing zero false all-clear verdicts and zero false negatives under induced data-source failures. When Morpheus is uncertain, it defers to a human.

Your own team can repeat this work. Break authentication to your SIEM, take an endpoint agent offline, audit the executed queries against the investigation summary, probe tenant isolation, and degrade a telemetry source. Define your pass criteria first. That is how this MSSP earned its own confidence in APD 2.0.

How APD Fits the Morpheus Architecture

APD is the investigation layer of the accountable agentic SOC platform. The architecture is 70% to 80% deterministic framework and 20% to 30% model reasoning, and the Cybersecurity Triage LLM at its center is purpose-built for SecOps. Deterministic code carries the steps that have to behave identically every time, and the reasoning layer handles the judgment calls.

Self-Healing Integrations detect API drift and auto-generate corrective code, so the telemetry APD depends on recovers when a vendor changes an API. Runtime Playbooks are generated contextually per incident, so response follows the path APD actually found. SOAR execution and case management sit in the same platform, which keeps the investigation record and the response actions together.

Governance runs at every stage, and every action leaves a traceable record. Autonomy stays auditable and reversible, and the analyst keeps the decisions that carry consequences.

Also see:
Agentic SOC guardrails
API drift

Frequently asked questions

What does Attack Path Discovery do?
Attack Path Discovery is Morpheus’s autonomous investigation engine. It runs L2-depth investigation on every alert, querying 800+ connected security tools simultaneously and reaching back 90 days through historical telemetry. The result is a complete attack timeline, MITRE ATT&CK mapping, and recommended response, assembled before any analyst opens the case. Investigations typically open within 30 seconds of the originating alert, and up to 95% of alerts receive L2-depth investigation in under 2 minutes. When Morpheus is uncertain, it defers to a human.

How is Attack Path Discovery different from legacy SOAR?
Legacy SOAR platforms execute pre-authored playbooks that engineers must build and maintain. Attack Path Discovery generates its investigation from live alert context, no pre-built playbook required. Where SOAR executes a fixed script, APD reconstructs the actual attack path behind each specific alert.

What do horizontal and vertical investigation mean?
Horizontal investigation, also called East-West tracing, means APD queries multiple security tools simultaneously at the same moment in time, correlating evidence from all connected tools in a single pass. Vertical investigation, also called North-South tracing, means APD queries backwards through historical telemetry, 90 days by default, configurable up to 365 days. That surfaces whether the current alert is an isolated event or part of a longer attack pattern that crossed your alert thresholds at a single point but was building for weeks.

Does APD work for vulnerability triage?
Yes. The same engine that investigates alerts also processes vulnerability findings, mapping chainable exploit paths across multiple CVEs that individually score below threshold but together represent a critical attack path. Static CVSS scoring cannot detect chainability. Attack Path Discovery does.

Is Attack Path Discovery a black box?
No. Every reasoning step APD performed, every tool call, every source consulted, and every confidence weight is recorded in a single audit trail per investigation. Analysts can inspect, challenge, verify, or override any conclusion. The audit trail is exportable and supports the evidence requirements of regulated industries. A large US-based MSSP audited that record query by query in 2026 and found a 100% match between the queries executed and the queries listed. When Morpheus is uncertain, it defers to a human.

What does APD do when a data source is unreachable?
It reports the problem instead of guessing. With Microsoft Sentinel authentication deliberately broken, APD 2.0 identified a permanent authentication issue and stated that its verdict could not be confirmed. With the CrowdStrike agent offline, it recognized a platform-wide issue and flagged that results could not be fully confirmed.

How does APD keep multi-tenant investigations separated?
Investigation guidelines act as enforceable policy. A guideline requiring the customer name in every Sentinel search was honored in 100% of queries during the MSSP’s cross-tenant probes. Scoping applies at the field level of the SIEM data, so other tenants’ results are excluded by construction. When Morpheus is uncertain, it defers to a human.

Related terms

SOAR Ceiling — The point at which legacy SOAR’s playbook maintenance burden exceeds its operational value.

Agentic SOC — A SOC architecture in which AI agents perform investigation and response tasks autonomously.

Bounded Agentic Reasoning — AI reasoning constrained to specific decision boundaries defined by deterministic governance.

Autonomous SOC — A security operations center in which AI systems perform alert triage, investigation, and response without requiring analyst intervention for routine cases.

Unified Intelligence Model — D3’s architectural principle of running all AI reasoning through a single engine with one audit trail.

Query transparency — The property that every query listed in an investigation summary was actually executed.

Cross-tenant data isolation — The guarantee that a multi-tenant investigation never mixes data between customer tenants.

Agentic SOC guardrails — Controls that stop an autonomous investigation from deciding on incomplete information.