MITRE ATT&CK

MITRE ATT&CK Mapping and Correlation

Behavior-Based Triage and Incident Response

Bring the world’s largest knowledgebase of adversary tactics and techniques into your security operations. Enrich every security alert with contextual information on tactics, techniques and sub-techniques as defined by the MITRE ATT&CK Matrix. Upgrade your threat hunting capabilities from event-based to intent-based response. Identify the entire scope of an incident based on indicators of compromise (IOCs) and ATT&CK Tactics, Techniques and Procedures (TTPs).

Smart SOAR MITRE ATT&CK Integration

When your detection tools tag alerts with potential ATT&CK techniques, Smart SOAR can correlate across your entire stack to validate that the technique is present. Our expert-built integrations are designed to close the gaps between tools and maximize the detection of ATT&CK techniques, so that larger attacks can be quickly uncovered.

Connect the dots between related events

Advanced integrations capture the data needed to confirm adversary techniques

Run MITRE-based playbooks to respond to TTPs

MITRE ATT&CK Mapping for Advanced Threats

With Smart SOAR’s Monitor module, detected techniques are mapped visually to the ATT&CK Matrix, enabling at-a-glance understanding of trends in the environment. SOC teams can put high-risk techniques under surveillance, triggering notifications when they are spotted in alerts. Scheduled threat hunting playbooks can be used to find evidence of certain techniques across past incidents and track down related TTPs.

Reveal your most pressing threats so you can better allocate resources

Measure TTPs over different time periods to track progress

Trigger automated playbooks based on TTP threat hunting

What is MITRE ATT&CK?

MITRE ATT&CK (Adversarial Tactics, Techniques, & Common Knowledge) is a framework developed by the MITRE Corporation for documenting common behaviors exhibited by cyber attackers, or adversaries, in real-world security incidents. It is organized into matrices, the most widely used of which is MITRE ATT&CK for Enterprise.

A graphic depicting a Smart SOAR dashboard presenting MITRE ATT&CK data.

Tactics

ATT&CK is broken down into 14 tactics that represent what an adversary is trying to accomplish, such as Initial Access or Privilege Escalation.

Techniques

Each tactic contains several techniques, which represent the behaviors an adversary may take to achieve their goal.

Additional Information

MITRE provides additional data for techniques, including mitigations and detections.

MITRE ATTT&CK Resources

Learn more about how Smart SOAR brings the power of the ATT&CK framework into your security operations.

What Are MITRE ATT&CK and MITRE D3FEND?

Ever wish you had a crystal ball for cyber threats? Meet MITRE ATT&CK and MITRE D3FEND, your digital fortune-tellers. In a fast-moving threat landscape, staying ahead of your adversaries is crucial. MITRE ATT&CK unveils adversary tactics, giving you the upper hand in fortifying your organization’s defenses. Meanwhile, MITRE D3FEND is all about defense strategies. Join…
MITRE ATT&CK Technique-Driven Automation with Smart SOAR

MITRE ATT&CK is invaluable for SOC teams in understanding adversary behaviors and actions across a range of networks. This robust framework offers granular insight into various attack tactics, techniques, procedures, and threat groups, thereby enabling cybersecurity teams to bolster their defense mechanisms effectively. Mature SOC teams depend on incident response automation tools to drastically cut…
The 10 Most Common MITRE Tactics & Techniques of 2023

SOAR solutions create a centralized queue of all incidents going on in a security team’s environment. Endpoint, SIEM, email, behavior, and network alerts are all collected inside of a holistic SOAR solution. As such, SOAR analytics are a unique way to understand your overall security environment and what threats you’re facing on a day-to-day basis.…