Traces the attack path and the data and signal sources needed to detect each step
Converged Detection Engineering turns each AN-THR into one or more AN-ATT entries and, for each step on each path, enumerates the data and signal sources needed to observe it. Each attack path is the ordered chain of Kestrel Orbital structural elements the adversary touches from initial access to objective, anchored by one TOE reference; the source inventory aligned to those steps is the second deliverable. Incident Response Preparation uses both to write detection signatures and playbooks.
AST : SI : Signal : 00 · telecommand uplink waveform. Objective element AST : HW : Hardware : 06 (on-board computer).AN : THR : Threat : 00 · KO-THR-01. TOE → PCE : OR : Orbital : 00.
One concrete path an adversary realising the threat would traverse, from uplink access to command execution on the vehicle.
| Field | Value |
|---|---|
| Identifier | AN : ATT : Attack Path : 00 |
| Description | Unauthenticated telecommand injection on the uplink: gain transmit access on the command uplink → present a forged telecommand to the Link access-control service → command accepted and routed by C&DH → command executed on the on-board computer. |
| Driven by | AN : THR : Threat : 00 (KO-THR-01) |
| TOE (one anchor element) | AST : SI : Signal : 00 Traversal, which is DESCRIPTION content and not the target: AST : SI : Signal : 00 → SVC : CP : Control Plane : 05 → SVC : HY : Hybrid : 00 → AST : HW : Hardware : 06 |
| Source | Kestrel Orbital red-team exercise RT-2026-Q1; command-link injection reconstruction against the Day-1 CONOPS uplink chain. |
| Confidence | High. Every step maps to a real enumerated element on the command path; the traversal was reproduced in the red-team exercise. |
TOE: AST : SI : Signal : 00TOE: SVC : CP : Control Plane : 05TOE: SVC : HY : Hybrid : 00TOE: AST : HW : Hardware : 06| Field | Required? | What to capture |
|---|---|---|
| LAYER / TAG / LABEL / ORDINAL | Required | Always AN : ATT : Attack Path : NN. |
| DESCRIPTION | Required | One short narrative of the path from initial access to objective; no marketing. |
| DRIVEN BY | Required | The AN-THR the path realises. Each AN-ATT names exactly one driver; cross-reference others. |
| TOE | Required | ONE fully-qualified enumerated element: the element this path is anchored to, the same element the AN-THR it realises names. Never a list. The route the adversary takes across the platform lives in the DESCRIPTION, because a target field holding four elements cannot say which one the finding is about, and both later functions read that field to decide what to watch and what to harden. |
| STEPS | Recommended | One bullet per traversal step, each naming the structural element it touches. Drives the source inventory and the detection scope inherited downstream. |
| RDS | Required | Required data sources: what a defensive cyber operator must be receiving as a record to see the adversary act. Sub-enumerated from RDS:00, each naming the source, the one element it is observed on, and its state: Available, Partial, Gap, or unassessed, which means no state has been returned yet and is deliberately not the same as a Gap. An empty field is an answer: this path leaves no records. |
| RSS | Required | Required signal sources: what must be measured in the physical layer, such as a noise floor, a carrier-to-noise ratio or a lock status. Same sub-enumeration and states. Separate from RDS because they are separate kinds of observable, and on a converged space platform the distinction decides whether a path is detectable at all: jamming is seen in the noise floor and never in a log. |
| SOURCE | Required | Red-team report, public incident analysis, government brief, or peer ISAC bulletin. Hypothetical paths must be marked exercise-only and segregated. |
| CONFIDENCE | Recommended | How well the path is corroborated. |
For each step on AN : ATT : Attack Path : 00, the data or signal source a defensive cyber operator needs to observe the step. Where no source exists, mark a detection gap. This inventory is a Converged Detection Engineering deliverable, read by Incident Response Preparation when authoring signatures.
| Path step (TOE) | Required data / signal source | Status on this platform |
|---|---|---|
| AST : SI : Signal : 00 | RF spectrum and uplink demodulation telemetry; unexpected carrier, framing, or command cadence on the command uplink. | Available; onboarded as src-rf-001. |
| SVC : CP : Control Plane : 05 | Link access-control audit: command source-authentication accept/reject and message-authentication-code verification result. | Available; onboarded as src-acalink-002. |
| SVC : HY : Hybrid : 00 | C&DH command receipt and routing log; command-counter continuity and out-of-sequence detection. | Available; onboarded as src-cdh-003. |
| AST : HW : Hardware : 06 | On-board computer command-execution log and FDIR events; unexpected command sequence on the bus. | Partial; execution logging present, FDIR event export to ground gap recorded as gap-obc-004. |
Validation rules. Before declaring the source inventory complete: every AN-ATT step has at least one row; every "Available" status names a real source identifier the SIEM operator can resolve; gaps are recorded explicitly and assigned an owner before launch.