replay_telemetry
Replay lab telemetry such as PCAP, EDR, or SIEM exports against an attack simulation to identify detection coverage gaps and strengthen defenses.
Instructions
Replay lab telemetry (PCAP/EDR/SIEM exports) against a simulation to identify coverage gaps
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| operator | No | Operator context required for restricted playback | |
| telemetry | No | Array of telemetry events (e.g., SIEM or EDR events) | |
| scenario_id | No | Optional scenario identifier to contextualise telemetry | |
| simulation_id | Yes | Simulation identifier returned by simulate_attack | |
| approval_token | No | ||
| telemetry_base64 | No | Base64-encoded JSON array of telemetry events (alternative to telemetry array) |