Attack Path Discovery: Autonomous L2 investigation on every alert.

Attack Path Discovery (APD) is D3 Morpheus’s autonomous investigation engine. It performs L2-depth investigation on every security alert by hunting horizontally across identities, endpoints, cloud, and email infrastructure — and vertically through up to 90 days of telemetry from the originating tool. APD correlates evidence, validates IOCs, reconstructs attack timelines, computes blast radius, and drafts context-aware remediation before an analyst opens the case.

Up to 95% of alerts reach L2+ investigation depth in under 2 minutes. The investigation is governed by the Cybersecurity Triage Reasoning Graph, which constrains the LLM’s reasoning at every step.

L1 triage bots classify and summarize alerts. They route alerts into queues, recommend escalations, and produce executive summaries. They do not perform investigation. The L2 work — pivoting across tools, reconstructing causal timelines, validating IOCs, computing blast radius — still falls to a human analyst.

APD performs the L2 work itself. The output is a complete case file with a reconstructed attack timeline, a data-source panel showing every tool queried, a MITRE ATT&CK mapping, a command-risk-tiered next action, and a unified audit trail — on every alert, not just the criticals.

SOAR playbooks execute predetermined steps in a fixed order — written by a human, run by the platform. When an investigation requires a step the author didn’t anticipate, the playbook fails or hands off to an analyst. APD doesn’t run playbooks; it generates the investigation by routing the LLM through the Cybersecurity Triage Reasoning Graph based on the alert type and the evidence surfaced at each step.

The graph constrains what the LLM considers — but the LLM decides how to investigate. This is the architectural difference between automation and autonomous reasoning. Morpheus includes a SOAR engine for cases where deterministic execution is the right choice, but APD is the investigation primitive.

Both. APD was designed around alert investigation, but the engine generalizes. Morpheus uses the same horizontal-hunting, vertical-hunting, and timeline-reconstruction pattern to triage vulnerability findings — including AI-discovered vulnerabilities from systems like Anthropic Mythos and OpenAI Codex Security.

Each vulnerability finding receives the same six-element case file as an alert investigation: ranked timeline (mapped to the vulnerability chain), data-source panel, attack path graph (showing chainability across findings), MITRE ATT&CK mapping, recommended next action, and audit trail. Only the input source changes. See the vulnerability triage use case for the full extension positioning.

Horizontal hunting is investigation across multiple security tools at the same point in time. APD correlates evidence from SIEM (Splunk, Sentinel), EDR (CrowdStrike), identity (Okta), cloud (Wiz), email (Microsoft 365), and network (Zscaler) tools simultaneously — assembling the full cross-domain picture of what was happening when the alert fired.

Vertical hunting is investigation into a single tool through time. APD walks back through up to 90 days of telemetry from the originating tool to surface the precursor events — the dropper that fired 36 hours earlier, the dormant scheduled task, the mailbox rule created last week — that the alert is the downstream consequence of.

Every APD investigation runs both dimensions in parallel.

The Cybersecurity Triage Reasoning Graph is D3’s domain-specific reasoning architecture for SOC investigation. Nodes encode security entities and concepts (alert types, attacker behaviors, tool capabilities, evidence categories); edges encode the relationships and reasoning patterns that connect them. The graph constrains what the LLM considers at every step of an APD investigation.

When APD investigates a suspicious sign-in, the graph routes the LLM to identity nodes first, then to endpoint nodes for processes associated with the user session, then to cloud nodes for resources the session accessed. The LLM never reasons about telemetry the graph hasn’t determined is relevant to the alert type.

Built over 24 months by 60 specialists in red teaming, data science, AI engineering, and SOC operations. The graph is the moat; the LLM is interchangeable — our defensible IP is the cybersecurity domain modeling, not the LLM. When a better model ships, we swap it in.

APD reaches across 800+ self-healing integrations. When a vendor pushes an API change that breaks a connector, Morpheus’s self-healing layer detects the break, generates a patched connector that maps the new schema to the same internal fields, runs the patched query, and returns evidence as if nothing changed.

Production MTTR on API drift: 18 minutes, measured across the Morpheus production fleet. Industry baseline for manual repair on traditional SOAR platforms: 4–6 weeks (connector triage, code patch, regression test, redeploy). The integration-drift tax that erodes every SOAR ROI is eliminated structurally, not patched operationally.

The audit trail records what changed and what was generated. The analyst never had to know.

An APD investigation produces the same artifact a senior L2 analyst would produce — a complete case file with timeline, evidence panel, attack-path graph, MITRE ATT&CK mapping, recommended response, and audit trail. The difference is consistency.

APD investigates every alert at L2+ depth, including the long tail of low-severity alerts a human analyst doesn’t have time for. It investigates at 3 AM Saturday with the same depth as Tuesday afternoon. It produces an investigation before the analyst opens the case — so analyst time is spent reviewing the work, not building it from scratch.

The audit trail is also a strict improvement over a human investigation: every reasoning step the graph took, every query APD issued, every action recommended or executed, every analyst decision — in one document per incident, structured for SEC, NIS2, DORA, and EU AI Act oversight obligations.