Manage matrices

Manage the matrices that have been imported from the MITRE TAXII collections. Matrices are a collection of tactics and techniques. You can view the matrices to review if your collections are available in the MITRE-ATT&CK repository.

시작하기 전에

주:

Review and verify that only the matrix you intend to use in your organization is set to active and disable the other matrices. For example, if you intend to use the Enterprise ATT&CK matrix, then the Enterprise ATT&CK matrix is activated at the TAXII collection level and in the Matrices level. Disable the other Mobile ATT&CK and ICS ATT&CK matrices at the TAXII collection and at the Matrices level.

Role required:

• sn_ti.admin: delete access
• sn_ti.read: read access
• sn_ti.write: create, write access

프로시저

1. Navigate to All > Threat Intelligence > MITRE ATT&CK Repository > Matrices.
   All matrices are disabled by default.
2. To activate a matrix, point to Active, double-click, and select true.
3. To view all the associated information, click a matrix.
4. To view all the tactics that are associated with this collection, click the MITRE Tactics tab.
5. To view additional details and the techniques that are associated with a selected tactic, click a tactic.
6. Under the MITRE ATT&CK Techniques tab, select a technique.
7. Under the related lists, view the associations that are available for the technique that you selected.

   In the following illustration, you can see the navigational path from the Enterprise ATT&CK matrix, to the Initial Access (TA0001) tactic, and then to the Phishing (T1566) technique. On the Attack Pattern - Phishing technique page, you can view the related list - Tactic, Sub Technique, Group, Mitigation, External References, Malware, and Tools.

   
   
   

다음에 수행할 작업

You can extend the information in some of these related list objects based on the technique that you selected. For example, you can add new information for Group, Mitigation, External References, Malware, and Tools.

관련 개념

• Auto-extract technique rules for importing MITRE-ATT&CK information

관련 태스크

• Set up the MITRE-ATT&CK framework
• Manage techniques
• Manage mitigations
• Manage groups
• Manage malware
• Manage tools
• Manage MITRE relationships
• Manage CVE and technique mapping
• Extend the MITRE-ATT&CK data
• Define the data source and detection tool mapping
• Define the data source and data component mapping
• Define the technique detection coverage
• Map your technique detection coverage to a technique
• Define the mitigation coverage
• Map your mitigation coverage to a technique
• Create and map detection rules
• Review threat group and MITRE-ATT&CK techniques mapping
• Threat group to technique heatmap definition
• Review the MITRE-ATT&CK system properties

관련 참조

• Get started with MITRE-ATT&CK framework
• Understand the MITRE to STIX data model
• Domain separation and MITRE-ATT&CK