Manage mitigations

Manage the mitigations that have been imported from the MITRE TAXII collections. Mitigations enable you to prevent an adversary from successfully executing techniques or sub-techniques against your organization. In STIX, mitigations are known as course of actions.

시작하기 전에

Role required:

• sn_ti.admin: delete access
• sn_ti.read: read access
• sn_ti.write: create, write access

프로시저

1. Navigate to All > Threat Intelligence > MITRE ATT&CK Repository > Mitigations.
   The mitigations are now listed.
2. Click a mitigation to view all the associated information.
   In the following illustration, you can view the details for Access Token Manipulation mitigation, its ID, source, and other related information.
3. To view how these objects are related, click Show Relationships.

다음에 수행할 작업

Use the techniques module to add or modify the mitigations data.

관련 개념

• Auto-extract technique rules for importing MITRE-ATT&CK information

관련 태스크

• Set up the MITRE-ATT&CK framework
• Manage matrices
• Manage techniques
• Manage groups
• Manage malware
• Manage tools
• Manage MITRE relationships
• Manage CVE and technique mapping
• Extend the MITRE-ATT&CK data
• Define the data source and detection tool mapping
• Define the data source and data component mapping
• Define the technique detection coverage
• Map your technique detection coverage to a technique
• Define the mitigation coverage
• Map your mitigation coverage to a technique
• Create and map detection rules
• Review threat group and MITRE-ATT&CK techniques mapping
• Threat group to technique heatmap definition
• Review the MITRE-ATT&CK system properties

관련 참조

• Get started with MITRE-ATT&CK framework
• Understand the MITRE to STIX data model
• Domain separation and MITRE-ATT&CK