A knowledge base for describing adversary behaviors.
5 resources
An ATT&CK mapping shows relevance to adversary behavior; detection coverage requires local evidence, tested scope, healthy dependencies, a consumer, and explicit uncertainty.
Use ATT&CK v19's Stealth and Defense Impairment tactics to reason about visibility degradation, while keeping tactic labels separate from proof of malicious intent or local coverage.
Understand ATT&CK Data Components as descriptions of security-relevant information, and migrate older Data Source mappings without mistaking taxonomy changes for deployed visibility.
Read MITRE ATT&CK v19 detection strategies, analytics, and data components as a layered knowledge model without mistaking framework mappings for deployed coverage.
Choose the analytic framework that matches your question: relationships with the Diamond Model, intrusion progress with the Kill Chain, or observable behavior with ATT&CK.
