MITRE ATT&CK AI Classification in ThreatConnect

Overview

The MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework is a knowledge base that uses metadata codes to standardize and classify adversary goals (tactics) and offensive actions (techniques). ThreatConnect® leverages the MITRE ATT&CK® framework in various areas across the platform to optimize the way you use your threat intelligence to understand adversaries, automate workflows, and mitigate threats.

Before You Start

User Roles

• To view ATT&CK Tags, your user account can have any Organization role.

Prerequisites

• Activate the CAL Automated Threat Library Source to view Tags applied to Report Groups in this Source. To activate the CAL Automated Threat Library Source, turn on the Active toggle for CAL Automated Threat Library on the Feeds tab of the TC Exchange™ Settings screen (must be a System Administrator to perform this action).
• Verify your ThreatConnect instance can receive data from cal.threatconnect.com (if using an On Premises instance).

How MITRE ATT&CK AI Classification Works

ThreatConnect uses a proprietary artificial intelligence (AI) classification model to read unstructured text from documents like reports and blogs attached to Report Groups in the CAL Automated Threat Library (ATL) Source and assess the content for relevant context clues to related techniques and sub-techniques in the MITRE ATT&CK framework. The MITRE ATT&CK AI classification model can identify 642 techniques and sub-techniques at a 95% confidence level. It returns these techniques and sub-techniques as system-level ATT&CK Tags associated to the Report Group containing the unstructured-text file. You can use these ATT&CK Tags as “at-a-glance” reference points, enabling you to quickly assess and pivot through large amounts of information in CAL™ ATL Reports, as well as any threat intelligence object to which you or another user has manually applied an ATT&CK Tag.

The model is monitored for accuracy and updated to support the latest version of the MITRE ATT&CK framework. When new techniques and sub-techniques are added to the framework, the model is trained to identify and “understand” them. Once the updates to the model meet ThreatConnect’s quality standards, the techniques and sub-techniques are released for use by the model.

Using MITRE ATT&CK AI Classification

You can leverage MITRE ATT&CK AI classification directly in the following ThreatConnect features:

• If the AI-powered features of Document Parsing Import are enabled, you can use MITRE ATT&CK AI classification to extract and import implicit MITRE ATT&CK Enterprise techniques and sub-techniques from the contents of an unstructured file or text block.
• When configuring the ThreatConnect Doc Analysis playbook app, you can select AI MITRE ATT&CK Classification from the Features dropdown to label text from an imported document identified as MITRE ATT&CK techniques and sub-techniques.
• The CAL Automated Threat Library Source contains all ATT&CK Tags, including those in the MITRE ATT&CK AI classification model. You can search for ATT&CK Tags when searching all object types on the Search screen or when searching Tags on the Search: Tags screen, and you can query for ATT&CK Tags on the Legacy Browse screen using ThreatConnect Query Language (TQL).

You can leverage ATT&CK Tags, including those applied automatically to CAL ATL Reports by the MITRE ATT&CK AI classification model, in a number of places in ThreatConnect, including the following:

• The Search screen
• The Legacy Browse screen
• Intelligence Requirements
• The ThreatConnect ATT&CK Visualizer
• Threat Graph

Techniques and Sub-techniques in the MITRE ATT&CK AI Classification Model

ThreatConnect^® is a registered trademark, and CAL™ and TC Exchange™ are trademarks, of ThreatConnect, Inc.
MITRE ATT&CK^® and ATT&CK^® are registered trademarks of The MITRE Corporation.

20166-01 v.04.A