How would you notice?
For every attack technique the usual question is: do we have a control? The more uncomfortable question is about visibility. MITRE ATT&CK answers it, and we have now made that answer importable.
When an attack technique comes up, the first question is almost always: do we have something against it? A hardening measure, a rule, a tool. The question is fair and produces a list of controls.
The second question is asked less often and matters more when it counts: how would we notice that it is happening?
ATT&CK answers both
MITRE's ATT&CK matrix is known for its techniques and the mitigations that go with them. Less known is the second part: for many techniques it also records which data sources could yield evidence at all, down to the component. Not "logs" but, say, process creation, logon activity, network flow.
That detail shifts the discussion. A technique that has a control but whose data source is collected nowhere is not covered, it is invisible. You learn about it when somebody else tells you.
One model, rebuilt three times
Implementing this surfaced a quirk you rarely see mentioned: MITRE has changed the way data sources attach to techniques three times since version 9.
In the early releases the source sat as a plain list on the technique itself. From version 10 there were separate objects for data sources and components, pointing at the technique through a relationship. Since version 17 a detection strategy sits in between, referring to analytics, and only those name the log source.
Read only the newest variant and older holdings return an empty list without anything looking broken. Our importer therefore covers all three forms. That is not an elegant solution, it is the only one that works with data that has grown over time.
Why the bundle sits in the repository
The matrix comes from a public repository that is normally fetched during import. That is exactly what an isolated network does not allow, and an ISMS frequently sits in one.
So a snapshot now ships with it, and the import works offline from that; the network fetch remains only a fallback. To make that defensible it was reduced to the object types actually read, from roughly 46 down to 6 megabytes. Threat groups, software and campaigns are not read by the parser anyway, so they are not in the repository either.
Each variant comes with a checksum and its provenance. A snapshot without those details would, a year on, be data of unknown origin, and that is precisely what produces questions nobody can answer later.
What you do with it
From the imported detail it becomes visible, per technique, which data sources evidence would require. Compared with what is actually collected, that yields a list of blind spots.
That list reads differently from an action plan. It does not say what should be done but what you currently cannot see.
More on the security automation module page.
Questions about this update?
Talk to us – we are happy to show you this feature in a demo.