Attack Path Discovery Configuration

Last Updated: October 29, 2026

Overview

Attack Path Discovery (APD) is the AI that investigates each event an intake brings in, reconstructs the attack path, and decides whether to dismiss the event or escalate it to an incident. Configuring APD means choosing which event intakes use it and writing, in plain language, the rules it follows. On an intake that uses APD, it replaces Event Automation Rules: instead of maintaining hand-written automation rules, you describe when an event should be dismissed, when it should be escalated, and how it should be investigated, so each event gets a reasoned decision.

The APD Policy editor

APD is set up under Configuration > Data Ingestion, on each event intake. On the Configuration home page, the Data Ingestion card leads to the same place. The rules for one intake are called its APD Policy.

In short

Before You Start

APD configuration needs three things in place, so that the button you look for is actually there and the rules you write can be saved.

• Data Ingestion on your site. APD, the Data Ingestion page and the Build with AI action on its home card appear only where D3 has made AI data ingestion available. If you do not see Data Ingestion under Configuration, contact D3 Support.

• An event intake. APD works on event intakes only, webhook or schedule. Incident intakes never offer it. On an existing intake, the Enable APD button appears once the intake has been saved; a new schedule can opt in while you add it.

• The right privilege. Turning APD on, and saving, publishing or applying feedback to the rules, all need the role privilege Edit APD Disposition Rules, in the Morpheus AI section of role settings. On upgrade, roles that could already configure playbooks receive it automatically.

Who Can Do What

Without Edit APD Disposition Rules, you can still open the editor and read every version. The Draft shows "You don't have permission to edit APD disposition rules. You can view the rules below, but editing, saving, and publishing are disabled.", and the edit, save and publish controls are disabled with a tooltip that names the privilege.

The Draft without the edit privilege

In the Add schedule and clone dialogs, a user without the privilege sees the APD switch locked, with the note "You don't have permission to enable AI disposition; the schedule will be created without it."

Turning On APD for an Intake

Turning on APD hands an intake's events to the AI investigation, so that the rules you publish decide what happens to each one.

Turning On APD for an Existing Intake

1. Go to Configuration > Data Ingestion and select the Event Intake tab.

2. Open the event intake. The Attack Path Discovery (APD) section is a separate card next to Additional Settings.

The Attack Path Discovery section of an event intake

3. Select Enable APD.

4. Read the confirmation, then select Enable APD in the Enable APD? dialog.

The Enable APD confirmation

An APD intake on the Event Intake list

Event Automation Rules under APD

If enabling fails, the message is "Could not enable APD". Check that your role has Edit APD Disposition Rules.

Turning On APD While Adding a Schedule

A new schedule can use APD from the moment it is created, so it never runs without it.

1. In the Add schedule dialog, switch on Enable APD when this schedule is created in the APD card.

2. Save the schedule.

3. Read the Create schedule with APD? confirmation, which notes "APD can't be turned off after the schedule is created." and "APD won't start investigating alerts until you publish a Disposition Rule for this schedule."

4. Select Create & Set Up Disposition Rules.

Creating a schedule with APD

Cloning or Adding Several Schedules

Cloning and batch creation let you set up APD on many schedules without repeating the same rules for each.

• Cloning a schedule that has APD. Select Copy the AI disposition rules to the clone to give the clone a copy of the source's published rules, so APD starts investigating on the clone straight away. If the source has no published rules, the option reads Enable APD with an empty rule set (the source has no published rules). If the source's rules cannot be checked, the clone is created without APD, and you can select Retry to copy the rules.

• Adding several schedules at once. Select Enable APD for all {n} schedules, then choose how the new schedules start:

The batch confirmation, Create {n} schedules?, states how many of them will have APD, and repeats that APD cannot be turned off after creation.

Using the AI Ingest Assistant

The AI Ingest assistant sets up a new intake and its APD rules through a chat, which is quicker when you are starting from nothing. Open it from the floating button on Data Ingestion, or from Build with AI on the Data Ingestion card of the Configuration home page. Describe what you want to ingest, review the result with View detail, and select Publish.

Stopping APD on an Intake

There is no supported way to turn APD off for an intake. If an intake must stop using APD, replace it with a new intake that does not use it.

1. Delete the APD intake.

2. Create a new event intake for the same source, and do not turn on APD. Create it from scratch; do not clone the old intake, because a clone copies APD.

3. Point the source at the new intake. A webhook intake gets a new key and request URL, so the sending system must be updated.

To stop APD for every intake on your tenant, contact D3 Support. This hides the Data Ingestion page and the APD results on all events, including earlier ones.

The APD Policy Editor

The APD Policy editor is where you write and publish the rules APD follows for one intake, with every published version kept so you can see what APD ran under and go back to it.

Open it in either of two ways:

• On Configuration > Data Ingestion > Event Intake, select the sparkle button on the intake's card (tooltip APD Policy). When the AI has left feedback you have not read, a chip such as 3 new sits beside the button.

• On the Configuration home page, use the Data Ingestion card under Intake and scheduling. View intakes opens the intake list, Add intake opens a new intake schedule, and Build with AI opens the AI Ingest assistant, which sets up an intake and its APD rules.

The Data Ingestion card on the Configuration home page

The editor has two top tabs: Intake Setup and APD Policy.

The Intake Setup Tab

Intake Setup holds the intake's own settings, such as its integration, site, authentication and field mapping, so you can check the source without leaving the rules. Changes on this tab save as you make them; the footer reads Changes save automatically, then Saving… and Saved. Once the intake is live, its integration and site are fixed. A live schedule-bound intake is read-only here, and changing it means creating a new rule.

The tab lists the intake's integration and site, its authentication and its field mapping. For a webhook intake it also shows the request URL and the key value the source sends with each event.

Versions

The APD Policy is kept as versions, so that changing the rules never touches what APD is running until you decide it should. The left rail of the APD Policy tab lists them, newest first:

The Draft's description tells you which version APD is running, for example "Your unpublished changes. The AI is still running Live v{n}, published {time}." Before the first publish, the rail reads "No published versions yet. Publish to make these rules live and start version history."

Writing the Rules

The rules tell APD, in your own words, which events to dismiss, which to escalate, and what to check on the way, so its decisions follow your SOC's judgment rather than a generic one.

Each rule is optional free text with Markdown, but a publish needs at least one. An empty rule reads "Not set — double-click or use the pencil to edit, or describe it in the chat."

To write a rule on the Draft:

1. Select the rule's tab: Dismiss, Escalate or Investigation Guideline.

2. Double-click the rule, or select the pencil.

3. Type the rule, or select Insert sample to add a ready-made clause.

4. Select Done.

Editing the Escalate rule

A rule is written as plain-language conditions, for example: "the event is a duplicate of an open incident". Insert sample adds a ready-made clause you can edit.

Escalation Routes

Escalation routes decide what an escalation turns into: for each reason APD escalates, which incident type, severity and playbook to use. They sit under the Escalate rule, introduced by "When the AI escalates, which incident it creates and which playbook runs."

Escalation routes

Select Add route for an empty row, or Add from template to start from a shipped one. A blank field keeps the site default.

Thinking Effort

Thinking effort sets how deeply APD investigates each event. The tiers are set by D3; the shipped tiers are Deep (the default), Standard and Light. Deep is the most thorough; Standard and Light trade some of that depth for speed. A tier D3 has retired shows (deprecated).

Effort is saved with each version, so you change it on the Draft and it takes effect when you publish.

Guidance Source

The Guidance source decides where the rules come from: written for this intake alone, or taken from an SOP your team maintains once in Morpheus Guidance and reuses across intakes.

The Guidance source choice

With an SOP selected, the Dismiss, Escalate and Investigation Guideline tabs are read-only, and they are filled in from the SOP's sections when you publish. To change them, edit the SOP in Morpheus Guidance or switch back to local guidance. A pinned policy tells you when a newer version exists, for example "SOP v{n} is available. This policy stays on v{n} until you update it.", with Update to v{n}. If an SOP is not offered, turn on APD for that SOP in Morpheus Guidance first.

Administrators can select Save as SOP to turn a Draft's local rules into a new SOP that other intakes can follow.

Choosing What APD Can Use

These two tabs let you narrow what APD may touch during an investigation, so it uses the tools and data you intend and nothing else.

Connections

The Connections tab decides which of your site's connections APD may use while it investigates, so it queries only the systems you intend. By default, APD uses every connection available to the intake's site: "Automatically uses all connections available to this Site." Selecting connections restricts the policy to them.

Restricting connections

1. On the Draft, select the Connections tab.

2. Select the connections APD may use, or use Select all / Deselect all.

A connection selected earlier but no longer available on the site is listed under "Previously selected — no longer available on this Site". On a published version the tab is read-only; select Edit connections in draft to change it.

Global Lists (If Enabled for the Site)

Global Lists let APD look up your own reference data, such as approved hosts or known accounts, while it investigates. The Global Lists tab is hidden unless D3 has made it available for your site, or a list is already bound.

Binding Global Lists

• Bind up to 10 Global Lists. The tab reads, for example, "2 of 10 lists bound. APD reads matching rows on demand, never the whole list."

• Refer to a list in a rule as {{list:Name}}.

• A list marked APD profile missing or Unavailable cannot be looked up. Problems with list references are counted as "{n} Global List issue(s) will block publish", and each such issue ends in " · blocks publish".

Binding lists, and publishing a Draft that binds them, also needs the Global List privilege.

Saving and Publishing

Saving keeps your work without changing what APD does; publishing makes the Draft the version APD runs from that moment on.

• Save Draft keeps your changes without making them live. The footer confirms "Disposition rules saved to draft".

• Discard reverts unsaved edits to the last saved Draft, after the confirmation "Discard {rules} changes?" (select Keep to stay).

To publish:

1. Select Publish. The button reads Validating… while it checks the Draft.

A newly published version

Restore copies a published version back into the Draft, so you can return to rules that worked. Select Restore Live v{n} to the Draft, then Restore.

Improving the Rules from AI Feedback

APD notes where your rules did not fit the events it saw, so you can tighten the rules from real cases instead of guessing. Notes appear on the Feedback tab of a published version after events run under it, and the {n} new chip on the intake's card tells you when there are unread ones.

1. Select a published version in the rail, then the Feedback tab.

2. Select the notes you want to act on.

3. Select Apply to rules. The button reads Refining… while the AI drafts the change.

4. In Review refined rules, read the word-level before and after of all three rules.

5. Select Accept changes, or Reject.

Turning feedback into rule changes

To clear notes without changing the rules, select them and select Dismiss. A version that has not run yet shows "No feedback yet for this version — the AI reports drift as events are processed under it." A policy that follows an SOP cannot take feedback until you switch it to local guidance.

Run Limits

Run limits keep AI investigations within the volume your plan allows, while making sure no event is silently left behind. Each limit counts the AI investigations started for an APD path over an hourly, daily, weekly, monthly or yearly window, and an All paths total can cap them together. When a limit is reached, each new event is either paused, so it is investigated automatically once the limit resets, or skipped, so an analyst can decide whether to run it. Either way, the event says what happened and when it can run, and the events list tells you how many are waiting.

Run limits in short

When a Limit Is Reached

What happens to an event that arrives after a limit is reached is set for your site by D3, and applies to every APD path:

Paused and Skipped Events

An event held by a run limit shows its state in place of an investigation result: on the event's APD panel, in the event quick view, in the event detail, and in the classic event window.

When the reset time is known, the label carries it, for example Skipped — usage limit, resets 16 Jan 00:00 UTC. Times are shown in UTC, with the date added when the reset is not today.

The AI Investigations Paused Banner

The paused banner tells everyone working the events list that investigations are on hold and when they resume, so nobody mistakes a quiet queue for a finished one. It appears above the events list in Workspace > Events, and above the events grid in the classic view, whenever at least one event is paused:

"AI investigations paused — usage limit reached. 3 events waiting; next automatic run ≈ 14:00 UTC."

When the next run is already due, the end reads "next automatic run due now". The banner disappears when no event is paused.

Rerunning an Event

Rerun investigation starts the investigation of a paused or skipped event straight away, so an urgent event never has to wait for a limit to reset. Anyone who can open the event can use it when the event offers it.

1. Open the event and go to its APD panel.

2. Select Rerun investigation.

3. In Rerun investigation?, select Overwrite existing incident widgets if the event is linked to an incident and you want the new result to replace the AI content there.

4. Select Rerun investigation in the dialog to confirm.

Manual runs come from a daily allowance that resets at 00:00 UTC. A rerun uses that allowance first, and only when it is used up does it count against the automatic limits. When a site has no separate allowance (the default), every rerun counts against the automatic limits.

Checking APD Usage

APD Usage shows administrators how much of each run limit is used, so you can see a limit coming before events start to pause. It is read-only.

1. Go to Global Settings > Application Settings.

2. Under Feature Settings, select APD Usage.

Who Sets the Limits

D3 sets the run limits and the related settings for your site, so they match your plan; they are not edited in D3 Morpheus. To change any of them, contact D3 Support.

RELATED ARTICLES

• (18.6) Attack Path Discovery Results

• (18.6) Morpheus Adaptive Tasking