Manage CVE and technique mapping

Manage the CVE and technique information that is mapped after you import the MITRE TAXII collections.

시작하기 전에

Role required:

• sn_ti.admin: delete access
• sn_si.admin: create, write, delete access
• sn_ti.read: read access
• sn_ti.write: create, write access

주:

The CVE-Technique Mapping module is available only when the Vulnerability Response product is installed in your environment.

이 태스크 정보

Once you import the MITRE TAXII collections you can view the CVEs in your environment and their relationship with the associated MITRE-ATT&CK techniques. You can also create associations with CVEs and the attack patterns.

프로시저

1. Navigate to All > Threat Intelligence > MITRE ATT&CK Repository > CVE - Technique Mapping.
   You can view the listed CVEs and techniques.
2. Click a CVE to view the vulnerability database entry.
   In the following illustration, you can view the details for the CVE list and for the vulnerability database entry for CVE-2014-7169.
3. To add an entry, click New, map the CVE to an Attack Pattern, and click Submit.
   In the following illustration, a new entry is created by mapping CVE-2014-0515 with the Masquerading attack pattern.

관련 개념

• Auto-extract technique rules for importing MITRE-ATT&CK information

관련 태스크

• Set up the MITRE-ATT&CK framework
• Manage matrices
• Manage techniques
• Manage mitigations
• Manage groups
• Manage malware
• Manage tools
• Manage MITRE relationships
• Extend the MITRE-ATT&CK data
• Define the data source and detection tool mapping
• Define the data source and data component mapping
• Define the technique detection coverage
• Map your technique detection coverage to a technique
• Define the mitigation coverage
• Map your mitigation coverage to a technique
• Create and map detection rules
• Review threat group and MITRE-ATT&CK techniques mapping
• Threat group to technique heatmap definition
• Review the MITRE-ATT&CK system properties

관련 참조

• Get started with MITRE-ATT&CK framework
• Understand the MITRE to STIX data model
• Domain separation and MITRE-ATT&CK