Learn what the MITRE ATT&CK framework is, why it matters, and how to use the Immersive dashboard to track and improve your team's coverage.
What is MITRE ATT&CK?
ATT&CK stands for adversarial tactics, techniques, and common knowledge. The MITRE ATT&CK framework is a matrix of tactics and techniques that threat hunters, red teamers, and defenders use to identify attack types and define risk. It started as an internal project and has grown into a public knowledge base that security vendors and consultants worldwide now use.
MITRE ATT&CK is a knowledge base of real cyber-attack tactics, techniques, and procedures. It gives structure to how we understand adversarial behavior.
Our labs map to tactics and techniques in the ATT&CK framework. As you and your team complete content, our ATT&CK heat map shows where your coverage is strong and where you need to improve.
Find out more on MITRE's website.
Why use MITRE ATT&CK?
The framework's organized approach lets you select the attack you need to validate your security strategy, then analyze your defense so you can expand your security controls.
When you map and measure skills to the MITRE ATT&CK framework, you can:
- Identify people with the right skills to respond during an incident as the situation unfolds.
- Visualize skill levels to measure and improve coverage areas that need investment.
- Address skill gaps and reduce cyber risk.
- Help individual users see real-world relevance – when they see their skills mapped against the framework, they're more engaged with the gamified learning experience.
Understanding the framework
The framework organizes a threat actor's tactics and techniques into a taxonomy. It helps with post-compromise detection in enterprises by showing the actions an attacker may have taken:
- How did the attacker get in?
- How are they moving around?
The framework answers these questions and helps you define your organization's security posture at the perimeter and beyond.
What are tactics?
A tactic is a high-level description of attacker behavior. It's a class of behavior type.
What are techniques?
A technique is a more detailed description of specific behavior types within that tactic class.
The ATT&CK Matrix
MITRE organizes attacker tactics and techniques into 13 different matrices, categorized at a high level as Enterprise, Mobile, and ICS.
Pre-ATT&CK is organized around an adversary's activity before they launch an attack. The remaining matrices align with how specific attacks run by computing platform. Threat hunters can use the ATT&CK framework to look for specific techniques that adversaries may use together. The framework is useful for measuring your organization's visibility against targeted attacks with the existing tools you've deployed across your endpoints and perimeter.
Accessing your dashboard
You can access the MITRE ATT&CK framework from the main navigation menu by selecting Frameworks.
There are two dashboards:
- Personal View – shows learners and employees how their cyber capability skills map to MITRE.
- Organization View – shows your organization's coverage of skills mapped to the framework.
What you can view depends on your role and permissions on the platform:
- Organization Managers – can see both the Personal and Organization dashboards. The Organization dashboard shows data for the whole organization.
- Team Admins – can see both dashboards. The Organization dashboard shows data only for the team(s) they manage.
- Individual learners – with no management permissions can see only the Personal dashboard, which shows how their skills map to the framework based on their lab completions.
How the dashboard works
Heat-map feature
As individuals and teams complete exercises, our ATT&CK heat-map dashboard shows where coverage is strong and where you need to improve.
Personal View: The heat map shows completed, in progress, or not started status for each technique. It also shows where we don't have labs mapped to a technique. You'll find a key in the bottom-left corner.
Organization View: The heat map shows coverage for the framework. The darker the shading, the higher the coverage. You can find a key in the bottom-left corner.
It's interactive
You can find out more about coverage by selecting the specific technique you're interested in. This shows information in a side panel:
- Personal View – the labs mapped to the technique and/or sub-technique, and your progress for each lab.
- Organization View – the number of users in progress and the number of users who completed. It also shows the number of labs on the platform mapped to the technique or sub-technique.
You can jump straight to the labs from here.
Personal view
Organization View
Accessibility features
You can:
- Scroll vertically and horizontally.
- Select and drag content or the framework around with the pan button (the icon that looks like a hand).
- Zoom in and out to find the techniques or sub-techniques you're interested in (plus and minus icons).
- Use fit-to-screen (arrows facing in opposite directions) – this fits all the columns into view on desktop devices.
- Hover over the action buttons shown above to see what keyboard shortcuts you can use for each action.
The framework dashboards are screen-reader friendly. If you have any issues interacting with the framework using your screen reader, please report the details to our customer support team. We're passionate about improving the accessibility of our platform and features.
Note: If you're accessing the framework dashboards on a mobile device, you won't have the pan and zoom functionality via the toolbar or shortcuts. You can still pan and zoom by touching your screen (dragging or pinching).
Coverage calculations
Coverage is based on the proportion of labs completed in each sub-technique by the people in your organisation.
Calculation details
Take the proportion of labs a user has done in a sub-technique as a number between 0 and 1. Add these values together for all the users in the organisation to get a value for the sub-technique. To get a value for the technique, we take the average of its sub-techniques.
In the heatmap, we compare all techniques to show areas in which you have relatively higher or lower coverage.
Example
The Forge Web Credentials has two sub-techniques in it; SAML Tokens and Web Cookies. Frank has completed half the labs in SAML Tokens (50% = 0.5) and none in Web Cookies (0% = 0). Aisha has completed all the labs in both sub-techniques (100% = 1).
SAML Tokens; 0.5+1=1.5
Web Cookies; 0+1=1
Forge Web Credentials; (1.5+1)/2 = 1.25
Adding labs to custom collections
You can use the MITRE ATT&CK framework to add labs to custom collections. This lets you target users with exercises that strengthen your cyber capabilities across the organization and reduce risk