  Although intrusion alerts can provide threat intelligence regarding attacker
strategies, extracting such intelligence via existing tools is expensive and
time-consuming. Earlier work has proposed SAGE, which generates attack graphs
from intrusion alerts using unsupervised sequential machine learning. This
paper proposes a querying and prioritization-enabled visual analytics dashboard
for SAGE. The dashboard has three main components: (i) a Graph Explorer that
presents a global view of all attacker strategies, (ii) a Timeline Viewer that
correlates attacker actions chronologically, and (iii) a Recommender Matrix
that highlights prevalent critical alerts via a MITRE ATT&CK-inspired attack
stage matrix. We describe the utility of the proposed dashboard using intrusion
alerts collected from a distributed multi-stage team-based attack scenario. We
evaluate the utility of the dashboard through a user study. Based on the
responses of a small set of security practitioners, we find that the dashboard
is useful in depicting attacker strategies and attack progression, but can be
improved in terms of usability.
