Accessing the ATT&CK Visualizer

Overview

You can use the ThreatConnect^® ATT&CK Visualizer to create standard ATT&CK views with Groups in ThreatConnect added as analysis layers, allowing you to view the MITRE ATT&CK^® Enterprise tactics, techniques, and sub-techniques used by the Groups. You can also use the ATT&CK Visualizer to import ATT&CK views created in the MITRE ATT&CK Navigator, allowing you to use ThreatConnect as a repository for all your ATT&CK views.

You can access the ATT&CK Visualizer from the ATT&CK screen and when searching, browsing, or viewing Groups in your ThreatConnect owners.

Before You Start

User Roles

• To access the ATT&CK Visualizer, your user account can have any Organization role.
• To view standard ATT&CK views, your user account can have any Organization role.
• To create standard ATT&CK views, your user account can have any Organization role.
• To view imported ATT&CK views, your user account can have any Organization role.
• To import ATT&CK views, your user account must have an Organization role of Standard User, Sharing User, Organization Administrator, or App Developer.

Accessing the ATT&CK Visualizer From the ATT&CK Screen

If your user account has an Organization role of Standard User, Sharing User, Organization Administrator, or App Developer, follow these steps to access the ATT&CK Visualizer from the ATT&CK screen:

1. From the Tools dropdown on the top navigation bar, select ATT&CK.
2. Click + Create ATT&CK View at the upper right of the ATT&CK screen and select one of the following options, or select a saved standard ATT&CK view or saved imported ATT&CK view from the Standard Views or Imported Viewstab, respectively, to open it in the ATT&CK Visualizer:
   • Standard View: Create a standard ATT&CK view and open it in the ATT&CK Visualizer.
   • Imported View…: Import an ATT&CK view built in the MITRE ATT&CK Navigator and open it in the ATT&CK Visualizer.

If your user account has an Organization role of Read Only User or Read Only Commenter, follow these steps to access the ATT&CK Visualizer from the ATT&CK screen:

1. From the Tools dropdown on the top navigation bar, select ATT&CK.
2. Click Explore ATT&CK View at the upper right of the ATT&CK screen to create a standard ATT&CK view and open it in the ATT&CK Visualizer, or select a saved standard ATT&CK view or saved imported ATT&CK view from the Standard Views or Imported Views tab, respectively, to open it in the ATT&CK Visualizer.

Accessing the ATT&CK Visualizer for Groups

When searching, browsing, or viewing Groups, you can open the ATT&CK Visualizer for a specific Group and create a standard ATT&CK view with the Group added as an analysis layer (Figure 1).

You can open the ATT&CK Visualizer while viewing Groups in the following areas of ThreatConnect:

• Details drawer: Click Visual Analysis in the header of a Group’s Details drawer and select Visualize ATT&CK.
• Details screen: Click Visual Analysis in the header of a Group’s Details screen and select Visualize ATT&CK.
• Search: All Object Types screen: Click a Group’s ⋯ menu and select Visual Analysis, followed by Visualize ATT&CK.
• Search: Groups screen: Click a Group’s ⋯ menu and select Visual Analysis, followed by Visualize ATT&CK.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.
MITRE ATT&CK^® and ATT&CK^® are registered trademarks of The MITRE Corporation.

20151-03 v.05.A