MITRE ATT&CK AI Classification in ThreatConnect

Overview

The MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework is a knowledge base that uses metadata codes to standardize and classify adversary goals (tactics) and offensive actions (techniques). ThreatConnect® leverages the MITRE ATT&CK® framework in various areas across the platform to optimize the way you use your threat intelligence to understand adversaries, automate workflows, and mitigate threats.

Before You Start

User Roles

• To view and pivot on ATT&CK Tags, your user account can have any Organization role.

Prerequisites

• Activate the CAL Automated Threat Library Source to view Tags applied to Report Groups in this Source (must be a System Administrator to perform this action).
• To leverage ATT&CK Tags in ThreatConnect Intelligence Anywhere, enable CAL on your ThreatConnect instance (must be a System Administrator to perform this action) and in your Organization (must be a System Administrator, Operations Administrator, or Accounts Administrator to perform this action).
• Verify your ThreatConnect instance can receive data from cal.threatconnect.com (if using an On-Premises instance).

How MITRE ATT&CK AI Classification Works

ThreatConnect uses a proprietary artificial intelligence (AI) classification model to read unstructured text from documents like reports and blogs attached to Report Groups in the CAL Automated Threat Library (ATL) Source and assess the content for relevant context clues to related techniques and sub-techniques in the MITRE ATT&CK framework. The MITRE ATT&CK AI classification model can identify 121 techniques and sub-techniques at a 95% confidence level. It returns these techniques and sub-techniques as system-level ATT&CK Tags associated to the Report Group containing the unstructured-text file. You can use these ATT&CK Tags as “at-a-glance” reference points, enabling you to quickly assess and pivot through large amounts of information in CAL™ ATL Reports, as well as any threat intelligence object to which you or another user has manually applied an ATT&CK Tag.

The model is monitored for accuracy and updated to support the latest version of the MITRE ATT&CK framework. When new techniques and sub-techniques are added to the framework, the model is trained to identify and “understand” them. Once the updates to the model meet ThreatConnect’s quality standards, the techniques and sub-techniques are released for use by the model.

Using MITRE ATT&CK AI Classification

You can leverage ATT&CK Tags, including those applied automatically to CAL ATL Reports by the MITRE ATT&CK AI classification model, in a number of places in ThreatConnect, including the following:

• the Browse screen
• the Search screen
• Intelligence Requirements
• the ThreatConnect ATT&CK Visualizer
• Threat Graph

You can leverage MITRE ATT&CK AI classification directly in ThreatConnect Intelligence Anywhere (ThreatConnect’s browser extension), the Doc Analysis Import feature, and the ThreatConnect Doc Analysis Playbook App. In addition, the CAL Automated Threat Library Source contains all ATT&CK Tags, including the ATT&CK Tags that are included in the MITRE ATT&CK AI classification model. You can also use ThreatConnect Query Language (TQL) to query for ATT&CK Tags on the Browse screen.

Techniques and Sub-Techniques in the MITRE ATT&CK AI Classification Model

ThreatConnect^® is a registered trademark, and CAL™ is a trademark, of ThreatConnect, Inc.
MITRE ATT&CK^® and ATT&CK^® are registered trademarks of The MITRE Corporation.

20166-01 v.01.A