\subsection*{RedEye}\label{redeye}
RedEye is an interactive open-source analytic tool, released by CISA \cite{redeye_cisa_site} (Cybersecurity and Infrastructure Security Agency) and  DOE's Pacific Northwest National Laboratory, to assist Red Teams and Blue Teams with visualizing and reporting command and control activities. RedEye is capable of parsing logs from attack frameworks (at the moment only Cobalt Strike framework's logs) to present complex data in a more comprehensible format. This enables operators to assess and display intricate information, evaluate mitigation strategies, and enhance decision-making processes. The tool allows users to upload campaign data to view relevant information such as beacons and commands.

The historical records of any campaign logs hosted on RedEye can be viewed at the graphical level associated with connected servers and hosts. Analysts can also examine key events in selected campaigns to identify payload activity and track attacker access paths, such as lateral movement activity or the use of credentials to escalate privileges on a device. Using data from analysts and the techniques used during the campaign, RedEye can also create presentations that can be shared with stakeholders and customers. All data collected from campaigns and analyst cases can be exported for customers. Blue teams can also use RedEye to quickly understand raw data from analytics, and identify attack methods and compromised hosts in order to do the right thing.

\begin{figure}[h]
    \centering
    \includegraphics[scale=.25]{Figures/chapter4/RedEye/RedEye_redteam.png}
    \caption{RedEye Red Team version}
    \label{fig:redeye_red}
\end{figure}
\begin{figure}[h]
    \centering
    \includegraphics[scale=.25]{Figures/chapter4/RedEye/RedEye_logs.png}
    \caption{The Raw Logs}
    \label{fig:redeye_logs}
\end{figure}

By downloading the latest release from the GitHub repository \cite{redeye_github}, it is possible to install RedEye on major operating systems. Depending on the startup mode, the tool can be activated in Red Team or Blue Team mode. The main difference between the two modes lies in the complete availability of all functions for the Red Team version, while the Blue Team mode offers a simplified version intended for reviewing campaigns exported from Red Team analyses. Once the program is launched, the server hosting the application will be started and accessible via a web browser on the local network. After creating the campaign, there will be a request to import a RedEye database file, which can be in either .sqlite or .redeye format, or Cobal Strike logs via the connection with its server. This file is either generated from a previous analysis using the RedEye program or imported from logs produced by Cobalt Strike. Due to the difficulty of finding online sources of the specific tool in those formats, the developers have provided two database files for demonstration purposes, thanks also to the community which communicated with the developers trough the issue panel in their repository. These files have been imported and represented in the subsequent images, one in the Red Team version of the application and one in the Blue Team version.

\begin{figure}[h]
    \centering
    \includegraphics[scale=.25]{Figures/chapter4/RedEye/RedEye_timeline.png}
    \caption{The Timeline visualization}
    \label{fig:redeye_timeline}
\end{figure}

From the first provided image (figure \ref{fig:redeye_red}), representing the Red Team version as indicated by the icon in the bottom left corner, we can observe the structure of the application, which also follows a single-page design. As with most dashboards, we can find a sidebar containing the main settings for usage. Immediately next to it is the beacon exploration section, where beacons can be grouped according to different categories. Beacon is Cobalt Strike's payload to model an advanced actor. In the example shown, a beacon has been selected, annotated by a fictional analyst, who categorized it with various tags and added a reference to the threat by linking it to the MITRE website. To display the logs, one can click on the reference link, and a window containing the raw logs will appear (figure \ref{fig:redeye_logs}). In the main part of the screen, we have two visualization components. The first one is the Beacon Graph, which represents the connections between various machines depicted as numbered circles. Inside these circles, the detected beacons are represented as dots. At the top, we have the Timeline (figure \ref{fig:redeye_timeline}), which not only provides a temporal indication of the discovered beacons but also allows users, through dedicated buttons, to recreate the temporal progression of the beacons. This update affects both the graph and the list, providing different observation points based on the selected date. Lastly, in the screen representing the Blue Team version of the application (figure \ref{fig:redeye_blue}), we can observe how the functions are limited both by the absence of related tools and by the reminders provided by the application.

Among all the showcased applications, RedEye is certainly the most active one, as its repository is updated weekly, and regular releases are provided. Another advantage of the tool and its developers is the presence of code testing, which is updated with each application update. This is likely due to the practical nature of the tool, rather than being solely research-oriented, as it is designed for real-world contexts even in its early versions. However, compared to the others, RedEye utilizes the visualization components provided by visualization techniques to a lesser extent, leaving room for a mixed interpretation of the classic data visualization and analysis approach.

\begin{figure}[h]
    \centering
    \includegraphics[scale=.25]{Figures/chapter4/RedEye/RedEye_blueteam.png}
    \caption{RedEye Blue Team version}
    \label{fig:redeye_blue}
\end{figure}
\FloatBarrier


