Accessing the ATT&CK Visualizer

In ThreatConnect^®, you can use the ATT&CK^® Visualizer to create standard ATT&CK views and see all tactics, techniques, and sub-techniques in the MITRE ATT&CK^® Enterprise Matrix, as well as those used by one or more Group objects. You can also use the ATT&CK Visualizer to import ATT&CK views created in the MITRE ATT&CK Navigator.

The quickest way to access the ATT&CK Visualizer is via the ATT&CK screen in ThreatConnect; however, you may also access it by selecting Visualize ATT&CK from the Visual Analysis menu on a Group’s Details drawer and Details screen.

Top Navigation Bar

Standard Users (and Higher)

1. Click ATT&CK on the top navigation bar in ThreatConnect. The ATT&CK screen will be displayed, showing all ATT&CK views you and other users in your Organization have saved.
2. Click the + Create ATT&CK View button (Explore ATT&CK View for Read Only users) at the top right of the ATT&CK screen and select one of the following options:
   • Standard View: Select this option to create a standard ATT&CK view and open it in the ATT&CK Visualizer.
   • Imported View…: Select this option to import a view built in the MITRE ATT&CK Navigator and open it in the ATT&CK Visualizer.

Read Only Users

1. Click ATT&CK on the top navigation bar in ThreatConnect. The ATT&CK screen will be displayed.
2. Click the Explore ATT&CK View button at the top right of the ATT&CK screen to create a standard ATT&CK view and open it in the ATT&CK Visualizer.

Details Drawer

1. On the top navigation bar, hover over Browse and select Groups or a specific Group type. The Browse screen will display a results table containing either all Groups or Groups of the selected type.
2. Click on a Group’s entry in the table on the Browse screen. The Group’s Details drawer will be displayed.
3. Click the Visual Analysis button at the top left of the Group’s Details drawer and select Visualize ATT&CK. The ATT&CK Visualizer will open and display a new standard ATT&CK view with the Group added as an analysis layer (Figure 1). Depending on the size of your screen and the number of tactics, techniques, and sub-techniques used by the Group (i.e., the number of ATT&CK Tags applied to the Group), you may need to scroll horizontally and vertically to view all contents on the screen.
   

    

Details Screen

1. Navigate to the Details screen for a Group.
2. Click the Visual Analysis button at the top right of the Group’s Details screen and select Visualize ATT&CK. The ATT&CK Visualizer will open and display a new standard ATT&CK view with the Group added as an analysis layer(Figure 1). Depending on the size of your screen and the number of tactics, techniques, and sub-techniques used by the Group (i.e., the number of ATT&CK Tags applied to the Group), you may need to scroll horizontally and vertically to view all contents on the screen.
   Important

   You cannot access the ATT&CK Visualizer from a Group’s legacy Details screen. To access the ATT&CK Visualizer with an Email, Signature, or Task Group added as an analysis layer to a new ATT&CK view, click the Visual Analysis button at the top right of the Group’s Details drawer and select Visualize ATT&CK, or create a new standard ATT&CK view and then add the desired Group as an analysis layer.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.
MITRE ATT&CK^® and ATT&CK^® are registered trademarks of The MITRE Corporation.

20151-03 v.03.A