MITRE ATT&CK AI Classification in ThreatConnect

Overview

The MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework is a knowledge base that uses metadata codes to standardize and classify adversary goals (tactics) and offensive actions (techniques). ThreatConnect® leverages the MITRE ATT&CK® framework in various areas across the platform to optimize the way you use your threat intelligence to understand adversaries, automate workflows, and mitigate threats.

Before You Start

User Roles

• To view and pivot on ATT&CK Tags, your user account can have any Organization role.

Prerequisites

• Activate the CAL Automated Threat Library Source to view Tags applied to Report Groups in this Source. To activate the CAL Automated Threat Library Source, turn on the Active toggle for CAL Automated Threat Library on the Feeds tab of the TC Exchange™ Settings screen (must be a System Administrator to perform this action).
• To leverage ATT&CK Tags in ThreatConnect Intelligence Anywhere, enable CAL on your ThreatConnect instance and in your Organization:
  • To enable CAL for your ThreatConnect instance, select the CALEnabled checkbox on the Settings tab of the System Settings screen (must be a System Administrator to perform this action).
  • To enable CAL in your Organization, edit your Organization on the Organizations tab of the Account Settings screen and select the Enable CAL Data checkbox on the Permissions tab of the Organization Information window (must be a System Administrator, Operations Administrator, or Accounts Administrator to perform this action).
• Verify your ThreatConnect instance can receive data from cal.threatconnect.com (if using an On Premises instance).

How MITRE ATT&CK AI Classification Works

ThreatConnect uses a proprietary artificial intelligence (AI) classification model to read unstructured text from documents like reports and blogs attached to Report Groups in the CAL Automated Threat Library (ATL) Source and assess the content for relevant context clues to related techniques and sub-techniques in the MITRE ATT&CK framework. The MITRE ATT&CK AI classification model can identify 121 techniques and sub-techniques at a 95% confidence level. It returns these techniques and sub-techniques as system-level ATT&CK Tags associated to the Report Group containing the unstructured-text file. You can use these ATT&CK Tags as “at-a-glance” reference points, enabling you to quickly assess and pivot through large amounts of information in CAL™ ATL Reports, as well as any threat intelligence object to which you or another user has manually applied an ATT&CK Tag.

The model is monitored for accuracy and updated to support the latest version of the MITRE ATT&CK framework. When new techniques and sub-techniques are added to the framework, the model is trained to identify and “understand” them. Once the updates to the model meet ThreatConnect’s quality standards, the techniques and sub-techniques are released for use by the model.

Using MITRE ATT&CK AI Classification

You can leverage ATT&CK Tags, including those applied automatically to CAL ATL Reports by the MITRE ATT&CK AI classification model, in a number of places in ThreatConnect, including the following:

• the Search screen
• the Browse screen
• Intelligence Requirements
• the ThreatConnect ATT&CK Visualizer
• Threat Graph

You can leverage MITRE ATT&CK AI classification directly in ThreatConnect Intelligence Anywhere (ThreatConnect’s browser extension), the Doc Analysis Import feature, and the ThreatConnect Doc Analysis Playbook App. In addition, the CAL Automated Threat Library Source contains all ATT&CK Tags, including the ATT&CK Tags that are included in the MITRE ATT&CK AI classification model. You can query for ATT&CK Tags on the Browse screen using ThreatConnect Query Language (TQL), and you can search for ATT&CK Tags when searching all object types on the Search screen or when searching and browsing Tags on the Search: Tags screen.

Techniques and Sub-techniques in the MITRE ATT&CK AI Classification Model

ThreatConnect^® is a registered trademark, and CAL™ and TC Exchange™ are trademarks, of ThreatConnect, Inc.
MITRE ATT&CK^® and ATT&CK^® are registered trademarks of The MITRE Corporation.

20166-01 v.02.A