MITRE
Connector Category: API Feed Source
About MITRE
CTIX integrates with MITRE ATT&CK to retrieve the latest tactics, techniques, and sub-techniques. The MITRE feeds also include threat actor and malware details. This integration enables security teams to enhance the ability to detect, prevent, and respond to cyber threats effectively. For more information, see MITRE Resources.
Use Cases
Map threats with the latest tactics and techniques used by adversaries.
Analyze and understand the tactics and techniques employed by specific threat actors or cybercrime groups. Based on the cybercrime groups of your interest, you can determine your offensive strategy.
Assess the coverage and effectiveness of security tools.
Benefits
Automatically update the ATT&CK navigator tactics and techniques in CTIX.
Correlate threat data objects with common attack patterns.
Configure MITRE as an API Feed Source
Configure MITRE as an API feed source to receive latest tactic and technique feeds from MITRE.
Before you Start
You must have the View API Feed, View Feed Source, Create Feed Source, and Update Feed Source permissions in CTIX.
Steps
To configure an MITRE as an API feed source in CTIX, do the following:
Go to Administration > Integration Management > FEED SOURCES > APIs.
Click Add API source.
Search and select the MITRE app.
Click Add Instance.
Enter a unique name to identify the instance name. For example, MITRE-ATT&CK.
The base URL is pre-filled with the default MITRE GitHub URL,
https://github.com/mitre/cti. You cannot update the base URL.Select Verify SSL to verify the SSL certificate and secure the connection between the CTIX and MITRE GitHub servers. By default, Verify SSL is selected.
Note
Cyware recommends you select Verify SSL. If you disable this option, CTIX may configure an instance for an expired SSL certificate. This may not establish the connection properly and CTIX will not be able to notify you in case of a broken or improper connection.
Click Save.
The MITRE instance is configured and you can view the MITRE feed channels. You can configure multiple instances by clicking Manage > Add More.
Configure MITRE Feed Channels
Configure the feed channels to retrieve Attack patterns, TTP, APT mapping, and intrusion set details from MITRE ATT&CK and store the feeds in a collection.
Steps
To configure a MITRE channel, do the following:
Go to Administration > Integration Management > FEED SOURCES > APIs.
Search and select the MITRE app.
Click the ellipsis on the top right corner and select Manage.
Click Manage Feed Channels.
Select a feed channel and enable the toggle.
Enter the date and time to start polling feeds. Select a date within 15 days from the current date.
Enter the name of the collection to group the feed data. For example, MITRE Feeds. CTIX creates the collection and stores all the feeds from the feed channel.
Select from one of the following Polling Cron Schedule types to define when to poll the data:
Manual: Allows you to manually poll from the source collection.
Auto: Allows you to automatically poll for threat intel from sources at specific time intervals. The default polling cron schedule is Auto.
Enter a frequency in minutes between 60 and 10080 minutes in Polling Time. The default polling time is 240 minutes.
Set a default TLP and confidence score to assign to the feeds that do not have a TLP and confidence score already assigned. By default, the default TLP and confidence score are set to Amber and 100 respectively.
Select any tags to identify and categorize the feeds.
(Optional) Enable the Broken Connection Retry Policy to allow the CTIX application to re-attempt any failed connection attempts to your Recorded Future account. The system will attempt to connect 10 times.
You can enter the retry interval in days, minutes, or weeks and also specify the retry interval and the retry count.
Enable Exponential Backoff Entry to progressively extend the wait time between retries for consecutive error responses. For example, for a 10-minute exponential retry interval, the system will re-attempt to connect in 10, 100, 1000, 10000, and so on minutes till the retry count value is met. Use this option to give your system resources some breathing time and resolve any service overload issues.
Click Save.
The feed channel is configured and you can poll feeds from the channel. You can enable the other feed channels, poll feeds, and view the feeds. For more information, see API Integrations.
Test MITRE Feed Channel Connectivity
Test the connectivity of the MITRE API feed channels to ensure that the connection with the correct API endpoint is established and you have permission to poll feeds.
Before you Start
Ensure that the MITRE API integration is enabled.
Ensure that the feed channel for which you want to test connectivity is enabled.
Steps
To test the connectivity of a feed channel, do the following:
Go to Administration > Integration Management > FEED SOURCES > APIs.
Search and select the MITRE app.
On a feed channel, click the vertical ellipses and select View Details.
In the Working Status section, click Test Connectivity.
If the connection is established, then the working status shows Running. If the connectivity testing results in an error, then the working status shows Connection Error. Hover over the tooltip next to Connection Error to view the error code.
Refer to the following table to understand the error codes:
HTTP Error Code | Error Description | Reason for the Error | Solution |
|---|---|---|---|
400 | Bad Request | The server is unable to process the request due to an error on the client side. | Contact Cyware Support. |
401 | Unauthorized | Either the integration credentials are incorrect or expired. | Check the validity of the credentials and update the credentials in the instance configuration. |
403 | Forbidden | The integration credentials do not have permission to poll feeds from the channel. | Update the permissions of the credentials or enter new credentials that include permission to poll feeds from the channel. |
404 | Not Found | The requested resource could not be found on the server. Either the base URL or the endpoint has been changed. | Contact Cyware Support. |
429 | Too Many Requests | The maximum number of requests allowed for the integration credentials is reached for the current duration. | Update the permission of the credentials or wait until the limit resets for the next duration cycle. |
502 | Bad Gateway | The server acting as a gateway or proxy received an invalid response from the upstream server. | Try again later or contact MITRE support. |
MITRE Feed Channels
CTIX provides a channel to poll feeds from MITRE. The following table lists the feed channel and the API endpoint used to retrieve feeds:
Feed Channel | API Endpoint |
|---|---|
Retrieve MITRE Events |
|