CTIX enables you to directly associate an attack pattern in Threat Data with the MITRE tactics. When you associate an attack pattern, it adds a custom technique in the existing or the Custom Base Layer in ATT&CK Navigator.
Before you start:
Ensure that you have the View Threat Data permission to use Threat Data.
To associate an attack pattern with MITRE tactics, do the following:
From Main Menu, select Threat Data under Collection.
Select Attack Pattern as the Object Type on the left side of the page.
Select a required threat data record.
Select Associate with MITRE Tactics under Quick Actions on the right side of the page.
Select Enterprise Matrix or Mobile Matrix to define the technique's matrix.
To define in which layer the technique appears, select from the drop-down.
By default, the custom technique appears in the Custom Base Layer.
Select the relevant tactics under which the technique must appear.
Click Save.
The attack pattern is now added to the relevant layers in ATT&CK Navigator. You can view the associated attack patterns in the specified layers with a C on them. The C distinguishes the custom techniques from the MITRE techniques.