Description should include tools used by threat actors to exploit networks.