SPECTER
SPECTER is Soveryne's threat and vulnerability intelligence. Its console lets you look up threat groups, the attack techniques they use, malware and tools, and known vulnerabilities (CVEs) in one shared, regularly updated catalogue.
What SPECTER covers
SPECTER has four modules:
| Module | What it does | Where you meet it |
|---|---|---|
| Threat Intelligence | A catalogue of adversaries (APT groups), MITRE ATT&CK techniques, and malware families and tools, built from reviewed public sources | The SPECTER console: Adversaries, Techniques, Malware, Sources and Source health |
| Vulnerability Intelligence | A catalogue of published vulnerabilities with their scores, exploitation status and affected products | The SPECTER console: CVEs. ATLAS also uses this catalogue to match what it discovers against known vulnerabilities. |
| Threat Modeling | Works out which adversaries matter to your organisation and how well your controls cover their techniques | Not in the console yet |
| Vulnerability Scanning | Checks your software against the vulnerability catalogue | Not in the console yet |
The catalogue is the same for every organisation. It is reference information gathered from public sources, not data about your organisation. You look things up in SPECTER; you don't add or change records.
Who uses it
| Role | What they do here |
|---|---|
| Everyone with access to SPECTER | Browse every page, open every record, search CVEs and use the graphs |
| Admin | The same, and also sees two extra diagnostic columns on Source health (Last Attempt At and Error Code) |
Nobody can edit, add or delete catalogue records in SPECTER.
Before you begin
Getting around
The header shows Soveryne and SPECTER on the left and your profile button (your initials) on the right. The navigation on the left has six pages:
| Page | What you find there | More |
|---|---|---|
| Adversaries | APT groups and other threat actors, with their targets and techniques. This is the page SPECTER opens on. | Threat intelligence |
| Techniques | MITRE ATT&CK techniques and subtechniques | Threat intelligence |
| Malware | Malware families and threat tools, with the groups that use them | Threat intelligence |
| CVEs | The vulnerability catalogue, with search and filters. It opens empty until you search or choose Browse newest CVEs. | CVEs |
| Sources | The sources the catalogue is built from, with their licensing terms | Sources |
| Source health | When each source was last brought up to date | Sources |
To go back to the Soveryne portal, select the Soveryne logo at the top left, or use your profile menu. Your profile menu shows your name, your email address, your role and workspace, and two actions:
Lists and records
Every page shows its records as a table. Below the table, a status line tells you how many records are shown and which page you are on, for example "50 records shown · Page 1". Use Previous and Next to move between pages of 50 records (CVE search results come 30 at a time). Refresh reloads the current page.
To open a record, click its name (the first cell of the row). The record opens in a panel with a heading, a row of summary figures and sections of detail. Fields that don't belong in a named section are collected in a collapsed Record metadata section at the end.
Records link to each other. For example, an adversary's record lists its techniques; click one to open that technique. A back button (Back to followed by the name of the record you came from) then returns you to where you were. Close a record with the close button in its top-right corner.
Links to outside websites, such as the MITRE ATT&CK site, open in a new tab.
Searching
Graph views
Adversaries, Techniques and Malware open as a graph: each record is a node, and the lines between nodes show how records are related. Use the view button in the toolbar to switch between the graph (Graph view) and the table (List view).
Layouts
Choose a layout under Layout:
Whichever layout you use:
You can also use the keyboard: press Tab to move between nodes and lines, Enter or Space to open the details, and the arrow keys to move a node (hold Shift for larger steps).
Filters
Open Filters above the graph to choose what it shows. The summary next to Filters shows your selection and how many nodes are hidden.
When you type in the search box in graph view, the graph keeps the matching nodes and the nodes directly connected to them.
The legend below the graph shows how many nodes, connections and groups are drawn, and explains the shapes used on the current page.
Reports and exports
SPECTER has no downloads or exports.
How SPECTER protects you
Troubleshooting
| Message | What it means | What to do |
|---|---|---|
| "Return to the application portal to sign in." | Your session has ended. | Go back to the Soveryne portal, sign in, and open SPECTER again. |
| "Records could not be loaded" | The page could not fetch its records. | Choose Refresh, or open the page again from the navigation. If it keeps happening, contact your Soveryne partner or support. |
| "Request failed (…)." | A request to SPECTER failed. | Try again in a moment. |
| "Details for … are unavailable in the current catalogue." | You followed a link to a record that the catalogue no longer contains. | Go back with the back button and choose another record. |
| "No visible nodes" | Your filters hide every node in the graph. | Choose Restore graph categories, or change your search or selection. |
For CVE search messages, see CVEs.
MITRE ATT&CK
SPECTER's technique and adversary information includes content from MITRE ATT&CK®. ATT&CK® is a registered trademark of The MITRE Corporation. SPECTER keeps ATT&CK identifiers, such as T1059 and G0016, and links each technique to its page on the MITRE ATT&CK website.