This project builds an integrated detection and attribution pipeline that goes beyond standard IDS alerting. Suricata processes seeded/replayed pcap traffic to generate detections, which are then enriched with geolocation (MaxMind GeoLite2) and passive OS fingerprinting (p0f) before being correlated against MISP-hosted threat intelligence — including MITRE ATT&CK Groups data — to attempt adversary attribution with a confidence score rather than forced matches. A FastAPI reporting layer generates formatted case reports on demand from any logged event. A continuous threat intelligence pipeline pulls structured feeds (abuse.ch, AlienVault OTX, CISA KEV) to keep attribution data current, and an automated assessment trigger runs the existing network security scanner when newly ingested threat intelligence is relevant to the environment's exposure and the last assessment has aged past a defined threshold. The result is a system that moves from purely reactive detection toward proactive, intelligence-driven defense.