Controlled network evidence for detection validation without building the traffic lab.
NetMetria-X Community is in pre-release validation. It generates ATT&CK-aligned packet evidence bundles with ground-truth context for detection engineers, traffic analysts, and security vendors.
It helps teams inspect network evidence without malware execution, endpoint agents, live command infrastructure, production traffic collection, or a dedicated traffic-generation lab.
Why it matters
Detection validation gets expensive when test traffic needs infrastructure
Detection teams need traffic that exercises specific behaviors and enough context to judge whether a rule, parser, sensor, or analyst workflow behaved correctly.
Creating that traffic often means assembling lab networks, endpoint images, services, sensors, routing, cleanup procedures, and documentation. That work costs time and money before the detection test even starts.
NetMetria-X Community is designed to reduce that burden by generating controlled packet evidence as an offline dataset bundle. The value is not only the PCAP. The value is usable detection evidence with known context.
Benefits
Built to reduce cost, risk, and ambiguity in validation traffic
No traffic lab buildout
Produce controlled packet evidence without building and maintaining a physical or virtual environment only to create validation traffic.
Ground truth included
Dataset context identifies the scenario, ATT&CK technique coverage, traffic purpose, timing, and intended interpretation.
Safe by design
No malware execution, no compromised hosts, no live command infrastructure, no endpoint agents, and no production network activity.
Works with standard tools
PCAP output can be inspected with standard packet and detection tools such as Wireshark, tshark, tcpdump, Zeek, Suricata, Snort, NDR tooling, SIEM pipelines, and custom workflows.
ATT&CK-aligned scope
Community focuses on a bounded MVP set of network-observable ATT&CK-aligned behaviors instead of claiming broad offensive simulation.
Deterministic generation
The same declared scenario input produces the same generated bundle. This supports verification and controlled comparison during development and reviewer evaluation.
Use cases
Built for teams that inspect, test, and explain network detections
Detection engineers
Evaluate IDS, SIEM, and NDR logic against controlled network-observable evidence with known ground truth.
Traffic analysts
Review packets, conversations, alerts, and scenario context without relying on sensitive production captures or real victim data.
Security vendors
Exercise parsers, sensors, rules, and detection pipelines against documented packet evidence with known behavior context.
Training teams
Teach packet analysis and detection workflows without distributing sensitive captures or running live attack tools.
Labs and research
Use controlled network evidence for experiments, comparisons, and classroom exercises where known answers matter.
Coverage review
Review specific network-observable behaviors without staging a real compromise.
Evidence bundle
PCAP output with context, not unlabeled captures
Live captures are valuable, but they are often noisy, sensitive, difficult to share, and hard to label with certainty. Unlabeled PCAP collections rarely tell an engineer what should have been detected.
NetMetria-X Community is designed to produce focused packet evidence for detection validation, paired with ground-truth context that explains what the traffic represents.
Use live captures to understand production reality. Use NetMetria-X when you need controlled network evidence with known answers.
Packet evidence
Generated PCAP output for standard packet and detection tools.
Ground-truth context
Scenario, ATT&CK, actor, timing, and traffic-purpose context for validation and review.
Observation perspective
Where enabled, sensor-visible outputs help reviewers compare complete ground truth against what a sensor would observe.
Community MVP is intentionally bounded. It is not claiming full ATT&CK coverage, full protocol coverage, or live-network indistinguishability across every scenario.
Early reviewers are being asked to evaluate whether the generated evidence is useful, explainable, and realistic enough for detection-validation workflows.
Boundaries
Realistic network evidence without offensive execution
NetMetria-X is intentionally not a breach simulator, malware framework, command-and-control platform, cyber range, endpoint emulator, PCAP replay tool, or live traffic injection system.
It produces packet evidence and ground-truth context for detection engineering. It does not compromise systems, deploy agents, operate attacker infrastructure, execute commands, replay traffic, or interact with production networks.
NetMetria-X is for evidence generation and validation workflows, not operational attack execution.
Early reviewer access
Help validate whether NetMetria-X Community is useful for real detection work
Request early reviewer access
Use this form to describe the detection workflow, traffic type, or validation problem you want to evaluate.