Fig. 3From: OMMA: open architecture for Operator-guided Monitoring of Multi-step AttacksRepresentation of an event tree δ j Back to article page