Each agent receives attack schemas, and information coming from filtered events. It processes that to form beliefs, or suspicions, which are shared among agents in a group as well as with the manager agent.