Darktrace is a learn-then-breach factory. Probe, baseline, then Antigena.

1. Why a score is not a factory

SOC chat at 10:41Z: finance laptop 10.10.8.22 opened RDP to 203.0.113.88. DETECT raised a model at score 82. The L1 comment is “Darktrace says it is ransomware.” Leadership then asks why it was allowed. Both sentences skip the product. They treat the factory as a signature engine that prints convictions.

Official Darktrace threat-detection language is the opposite. Self-Learning AI is trained per deployment. It continuously ingests live data, builds a pattern of life for assets, peer groups, and the organisation, and flags behaviour that is both anomalous and unlikely to be benign — without relying on signatures, rules, or threat intelligence. A high score means rare versus that learned self. It does not name a malware family. It does not prove a hash. It does not prove Antigena acted.

Hero · the factory floor

Concept first: the object is the device in the model, not the Slack paraphrase. Path second: official Threat Visualizer surfaces in a fixed order. Do third: Side A builds the floor (probes), Side B reads the apprenticeship and the printed ticket (baseline + breach), Side C reads the action stamp (Antigena). Miss a stamp and you troubleshoot the wrong layer.

2. Mental model — four stamps on one ticket

Hold four parts. Interviews fail when people mix them. Darktrace publishes these as separate products and UI surfaces. You do not buy four factories. One appliance chain writes four stamps, in this order, only if the previous stamp exists.

Pre-train the vocabulary before the runbook. A model defines conditions; when they are met, Darktrace raises a model breach. Official DETECT blogs publish names in Category / Behaviour form — Device / Reverse DNS Sweep, Compromise / Ransomware / Suspicious SMB Activity, Compromise / Beaconing Activity To External Rare. Enhanced Monitoring models are higher-fidelity DETECT models, still not malware proof. Would-have is what RESPOND would do in Fully Autonomous. Acknowledge assigns an owner in Threat Visualizer — it does not isolate the host. vSensor is the virtual probe that needs a working SPAN (or osSensor feed) and a master appliance.

Official Self-Learning AI stack (Darktrace threat-detection glossary): live training data unique to the deployment; Bayesian models that update with new evidence; clustering so a peer group can stop the AI from mis-learning malice as normal; anomaly scores plus a meta-classifier that ranks rarity. That is why a CEO laptop in a peer set of one scores like an incident on every new SaaS. The comparison set is the apprenticeship, not a bug in the model.

3. Learn, then breach

The factory is sequential on purpose. Packets hit a SPAN / TAP / ERSPAN, a vSensor or physical probe, then the master. Pattern of life updates. A model’s conditions match — then, and only then, you have a breach. Later packets on a healthy sensor keep teaching the same device. That is why “we just installed Darktrace yesterday” and “the core change at 01:00 killed the SPAN” are different tickets that look the same in Slack: a red number, or no number at all.

Path · coverage diamond before DETECT

4. How to choose the next stamp

You are not choosing a product. You are choosing which stamp the factory is allowed to write — and which ticket you open when a stamp is missing.

Official Autonomous Response can run fully autonomously or inside guiderails — certain times, certain devices, certain events. Darktrace’s own wording: many organisations start in Human Confirmation and switch to fully autonomous within weeks. That switch is policy, not a night-shift reflex. Source: Darktrace Autonomous Response product page.

5. Runbook Side A → B → C

Lab values only. Master DT-MASTER-LAB-01, vSensor SENSOR-LAB-17, device finance-lap / 10.10.8.22, new peer 203.0.113.88 (RFC 5737), breach MB-1042. Nothing here is a live tenant. Confirm every click path on customerportal.darktrace.com for your Threat Visualizer version before production.

Side A — probe coverage (building the factory floor)

Primary source: Darktrace Customer Portal — System Config (Probes, Push Probe Tokens) + vSensor deployment notes. Official objects: physical probe, vSensor, osSensor.

1. Name the probe that should see this VLAN

   System Config → Probes (some builds: Admin → System Config). Find SENSOR-LAB-17. Type = vSensor. Master = DT-MASTER-LAB-01. A green Threat Visualizer homepage is not probe health. Quote connected / disconnected and last check-in.

2. Prove the SPAN, not only the VM

   Official: a vSensor spans traffic from a virtual switch and sends data to the master appliance. If you cannot SPAN, osSensors on the guests feed the vSensor. A connected vSensor with collapsed packets/s after a core or vMotion change is a monitor-session / promiscuous-port / ERSPAN ticket. Quiet PPS on a busy VLAN is a tap story, not a tuning story.

3. If the floor is dead, stop DETECT talk

   Open a coverage ticket with the network owner. Do not write a model exception for traffic you never captured. Darktrace is explicit: you cannot detect what is not on the wire. Source: Darktrace / NETWORK coverage + Customer Portal System Config.

Side B — device baseline, then the model breach (learning, then printing the ticket)

Primary source: Darktrace Customer Portal — Threat Visualizer User Guide (Device Summary, Device Event Log, Model Breaches / Model Breach Event Log) + darktrace.com/cyber-ai-analyst.

1. Search the host before you argue the score

   Threat Visualizer search: hostname, IP, or MAC. Open Device Summary. Official fields: First Seen, Last Seen, Operating System, subnet, tags. If search returns nothing, stop. There is no model breach to chase. A host First Seen tonight has almost no pattern of life — that is a new-device baseline, not ransomware.

2. Read the Event Log, then the peers

   Select the device → Device Event Log. Official TV workflow: review connections over time in the ticket UTC window. Quote dest / proto / first-seen of the new peer — or quote “no connections in window.” Peer group of finance laptops with n=3 tagged wrong is a noisy score, not a broken model. Encrypted payloads still leave dest, volume, timing, and peers.

3. Open the Model Breach Event Log, not Slack

   Threat Visualizer → Model Breaches (Threat Tray) → the breach → Model Breach Event Log. Quote the full published name, the score / priority, the timestamp, and acknowledged vs unacknowledged. Lab ticket: Compromise / RDP / Unusual External Destination, score 82, unacknowledged. Say “high score unusual external RDP,” not “ransomware.”

4. Use Cyber AI Analyst as a lead

   Path: Threat Visualizer → Cyber AI Analyst. Official product: it autonomously investigates relevant model alerts, forms hypotheses, and writes a natural-language incident. Quote the incident title and the related model breaches. It is not a malware family name and it is not containment. Fewer than 4% of investigations requiring human review is a Darktrace claim about scale — it is not permission to close without reading the models.

Path:            Threat Visualizer → Devices → 10.10.8.22
                 → Model Breaches → MB-1042 → Event Log
Device:          finance-lap · 10.10.8.22 · VLAN20
First Seen:      2025-11-02 08:14Z
Last Seen:       2026-08-16 10:41Z
Peer group:      Finance laptops · n=3 (re-tag before you trust 82)
Model:           Compromise / RDP / Unusual External Destination
Score / status:  82 · unacknowledged
New peer:        203.0.113.88 proto RDP first-seen 10:41Z
AI Analyst:      Word → never-before-seen public RDP · lead only
IOC:             none · not a close
Do not:          say “ransomware” or open Model Editor from an empty log

Side C — Antigena / RESPOND (the action stamp)

Primary source: Darktrace Autonomous Response product page + Customer Portal System Config → Antigena + “How RESPOND Neutralizes Zero-Day Ransomware.”

1. Quote the mode before anyone asks “why”

   Device Summary shows Antigena state for that host / group. Estate-wide switch lives at System Config → Antigena (Autonomous Response / Antigena Network). Official modes: Human Confirmation versus Fully Autonomous. Human Confirmation will not block. Confirm the live wording on your version — UI may say Passive / Active, Human Confirmation / Fully Autonomous, or RESPOND.

2. Read last action, then would-have

   Official out-of-the-box actions (no scripting): Automatic (best option from the alert), Block matching connections, Enforce device or group pattern of life, Block all incoming / outgoing or quarantine, third-party integration (firewall, Microsoft Defender for Endpoint, CrowdStrike). Published Antigena model names look like Antigena Ransomware Block and Antigena / Network / Significant Anomaly / …. If last action is none and mode is Human Confirmation, the proof field is would-have — for example “block RDP to 203.0.113.88” or “enforce pattern of life.” That sentence is what you tell the CISO.

3. Isolate now; Fully Autonomous later

   Blocking this RDP (firewall, NAC, EDR, or a targeted Antigena action if you already have Fully Autonomous on that model) is incident response. Flipping the group to Fully Autonomous is change-control — owner, model list, rollback. Official Active-mode story: RESPOND stopped never-before-seen ransomware with no public IOC, enforced pattern of life in seconds, then quarantined patient zero for 24 hours — only because it was actually on. Source: darktrace.com — How RESPOND Neutralizes Zero-Day Ransomware.

4. If it is a known backup, exception with a leash

   Model Editor / model exception: owner, reason, expiry. Never disable Compromise / Ransomware / Suspicious SMB Activity forever. Ack the breach with a note. Ack is not remediation.

Proof · named field, then Closed

6. Runtime — AI Analyst, exceptions, old baselines

Once the sensor is healthy, every interesting minute looks the same. Packets hit SPAN / TAP → vSensor or physical probe → master. Self-Learning AI updates pattern of life for the device and its peer group. A model’s conditions match → model breach with score / priority. Cyber AI Analyst may attach a written incident, re-investigate as new evidence arrives, and recommend actions. If Antigena is Fully Autonomous for that model and group, a proportionate action fires. If Human Confirmation, you get would-have only. Analyst acknowledges, hunts, isolates, or files a time-boxed exception.

Official RESPOND actions are surgical on purpose. Enforce pattern of life only allows what Darktrace already considers normal for that device or its auto-identified peer group. Block matching connections stops this connection and future matches (the published ransomware case blocked anomalous SMB, then quarantined patient zero for 24 hours while normal business continued). That is why “just quarantine the VLAN” is the wrong student reflex — and why Fully Autonomous on a mis-tagged CEO laptop is also wrong.

Secondary STIX/TAXII intelligence can be ingested to detect known threats or create custom detections based on existing IoCs. Official product still leads with behavioural detection. Closing a high-score new-peer breach because external intel is “unrated” is the opposite of the published zero-day ransomware story.

Exceptions live in Model Editor. They are how you tell the factory “this backup window is normal for this tag.” They need an owner and an expiry. An open-ended suppress is how ransomware hides in the backup window. Enhanced Monitoring is how you raise fidelity on a crown-jewel subnet after the peer group is honest — not how you compensate for a dead SPAN.

A host that joined tonight will keep scoring. That is the apprenticeship. Quote First Seen. Do not disable models. Do not treat every new-device breach as confirmed ransomware. After a few days of honest traffic, the same model gets quieter. If it does not, check tags and the probe before you touch thresholds.

7. Traps + Threat Visualizer proof

Next: take the same dummy fields as full night-shift tickets on the Darktrace evidence desk. Practice them on the Darktrace dummy lab.

Sources

• Darktrace Customer Portal — confirm live Threat Visualizer paths, Device Summary, Model Breach Event Log, Model Editor, System Config → Probes / Antigena on your version before you click in production
• Darktrace / NETWORK — Self-Learning AI on your data, Cyber AI Analyst, autonomous response, encrypted + decrypted traffic analysis
• Darktrace threat detection glossary — pattern of life for assets, peer groups, and the organisation; Bayesian + clustering; no signatures required
• Cyber AI Analyst — autonomously investigates relevant model alerts, hypotheses, natural-language incidents
• Autonomous Response — Human Confirmation vs fully autonomous; enforce pattern of life; block matching connections; quarantine; guiderails
• How RESPOND (formerly Antigena) neutralized zero-day ransomware — Active / Fully Autonomous, no public IOC, Compromise / Ransomware / Suspicious SMB Activity, Antigena Ransomware Block, Device / Reverse DNS Sweep
• Customer Portal · syslog JSON schema — Model Breach Alert vs AI Analyst Alert; a model is a set of conditions (confirm path on your portal build)

Related: Blog 2 · Evidence desk · Darktrace interview hub · Dummy lab · Models & breaches · Autonomous response

Dummy lab data only. No live tenant IDs. Confirm syntax, menu labels, and change-control on the production release via the Customer Portal.