Skip to main content

Cyware Threat Intelligence eXchange

Associate Attack Pattern with MITRE

Intel Exchange enables you to directly associate an attack pattern in Threat Data with the MITRE tactics. When you associate an attack pattern, it adds a custom technique to the existing or the Custom Base Layer in ATT&CK Navigator.

Before you start

Ensure that you have the View Threat Data permission to use Threat Data.

Steps

To associate an attack pattern with MITRE tactics, follow these steps:

  1. Go to Main Menu > Collection > Threat Data.

  2. Select Attack Pattern as the Object Type.

  3. Select a required threat data record.

  4. Select Associate with MITRE Tactics under Quick Actions on the right side of the page.

  5. Select Enterprise Matrix, Mobile Matrix, or ICS Matrix to define the technique's matrix.

  6. To define in which layer the technique appears, select from the drop-down.

    By default, the custom technique appears in the Custom Base Layer.

  7. Select the relevant tactics under which the technique must appear.

  8. Click Save.

    The attack pattern is now added to the relevant layers in ATT&CK Navigator. You can view the associated attack patterns in the specified layers with a C on them. The C distinguishes the custom techniques from the MITRE techniques.