Targets
2
Services
2
Findings
12
Runs
5
Campaigns
0
How to use this case
One engagement graph in Hermes. Flowers (Poppy, Rose, Lily…) feed adapters into this case. Authorize here; open a flower UI only when you need the native panel.
- Targets / Services — assets and attack surface from recon & ingest
- Findings — sessions, hooks, loot with MITRE tags (purple notes for defenders)
- Runs — audit trail of what executed against this case
- Campaigns — SE allowlists and kill-switch status
phase3-check rows are hub verify fixtures — not live production intel.
Finding mix
Rolled up by type · flower| Type | Flower | Count | MITRE |
|---|---|---|---|
poppy_event |
Poppy | 4 | ['T1185'] |
msf_loot |
Rose | 3 | ['T1005'] |
msf_session |
Rose | 3 | ['T1210'] |
poppy_hook |
Poppy | 2 | ['T1185'] |
Recent runs
| When | Flower | Status | Run id |
|---|---|---|---|
| 2026-10-25 08:15:49.453188-04:00 | Poppy | completed | 29a6f426-cc9e-46d8-ab0d-bc2c0c549a55 |
| 2026-10-25 08:15:48.766747-04:00 | Rose | completed | af66f546-b2bd-4f51-ae16-b05cc4c17f1a |
| 2026-10-25 08:15:22.806509-04:00 | Rose | completed | 19fbf9cf-b49d-4f63-a54b-07e8900f1484 |
| 2026-10-25 08:15:18.121103-04:00 | Poppy | completed | c93e8953-997d-4b57-8342-597793d125d1 |
| 2026-10-25 08:15:17.441499-04:00 | Rose | completed | 66bb0f25-b971-4df1-91db-92acb82a8bc5 |
Targets
Hosts / IPs in this engagement| Host | IP | Source |
|---|---|---|
| web.lab.local | 10.0.0.50/32 |
Rose |
| app.lab.local | 203.0.113.10/32 |
Poppy |
Services
Attack surface| IP | Port | Proto | State | Service | Product |
|---|---|---|---|---|---|
10.0.0.50/32 |
22 |
tcp | open | ssh | |
10.0.0.50/32 |
80 |
tcp | open | http | nginx |
Findings
Detail rows · MITRE for purple team| ID | Type | Flower | MITRE | Note |
|---|---|---|---|---|
| 12 | poppy_event |
Poppy | ['T1185'] | Browser module/event; correlate with hook session. |
| 11 | poppy_event |
Poppy | ['T1185'] | Browser module/event; correlate with hook session. |
| 10 | poppy_hook |
Poppy | ['T1185'] | Browser hook; proxy/CDN logs, unusual JS beacons, WebSocket to Poppy host. |
| 9 | msf_loot |
Rose | ['T1005'] | Loot/collection event; file-access and credential-dump telemetry likely. |
| 8 | msf_session |
Rose | ['T1210'] | Interactive session; expect EDR process trees, unusual parent/child, C2 beacons. |
| 7 | msf_loot |
Rose | ['T1005'] | Loot/collection event; file-access and credential-dump telemetry likely. |
| 6 | msf_session |
Rose | ['T1210'] | Interactive session; expect EDR process trees, unusual parent/child, C2 beacons. |
| 5 | poppy_event |
Poppy | ['T1185'] | Browser module/event; correlate with hook session. |
| 4 | poppy_event |
Poppy | ['T1185'] | Browser module/event; correlate with hook session. |
| 3 | poppy_hook |
Poppy | ['T1185'] | Browser hook; proxy/CDN logs, unusual JS beacons, WebSocket to Poppy host. |
| 2 | msf_loot |
Rose | ['T1005'] | Loot/collection event; file-access and credential-dump telemetry likely. |
| 1 | msf_session |
Rose | ['T1210'] | Interactive session; expect EDR process trees, unusual parent/child, C2 beacons. |
Tool runs
| Run | Flower | Status | Started |
|---|---|---|---|
| 29a6f426-cc9e-46d8-ab0d-bc2c0c549a55 | Poppy | completed | 2026-10-25 08:15:49.453188-04:00 |
| af66f546-b2bd-4f51-ae16-b05cc4c17f1a | Rose | completed | 2026-10-25 08:15:48.766747-04:00 |
| 19fbf9cf-b49d-4f63-a54b-07e8900f1484 | Rose | completed | 2026-10-25 08:15:22.806509-04:00 |
| c93e8953-997d-4b57-8342-597793d125d1 | Poppy | completed | 2026-10-25 08:15:18.121103-04:00 |
| 66bb0f25-b971-4df1-91db-92acb82a8bc5 | Rose | completed | 2026-10-25 08:15:17.441499-04:00 |
Campaigns
SE allowlistsNo campaigns on this case.