---
title: "MITRE ATT&CK App Overview | ThreatConnect"
slug: "mitre-attack-app-overview"
description: "This article provides an overview of the MITRE ATT&CK App and Source feed in ThreatConnect and the corresponding minimum roles and prerequisites for this feature."
tags: ["Viewing Data"]
updated: 2024-01-23T14:53:26Z
published: 2024-01-23T14:53:26Z
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MITRE ATT&CK App Overview

## Overview

The MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework is a knowledge base that uses metadata codes to standardize and classify adversary goals (*tactics*) and offensive actions (*techniques*). The framework also classifies software tools and capabilities (s*oftware*) and sets of related intrusion activity (g*roups*). Users can enrich objects in ThreatConnect with Enterprise ATT&CK metadata via the Tags provided in the **MITRE ATT&CK**Source.

For more information about MITRE ATT&CK®, see the following resources:

- [MITRE ATT&CK website main page](https://attack.mitre.org/)
- [ATT&CK 101](https://medium.com/mitre-attack/att-ck-101-17074d3bc62)
- [Enterprise ATT&CK tactics](https://attack.mitre.org/tactics/enterprise/)
- [Enterprise ATT&CK techniques](https://attack.mitre.org/techniques/enterprise/)
- [Enterprise ATT&CK software](https://attack.mitre.org/software/)
- [Enterprise ATT&CK groups](https://attack.mitre.org/groups/)
- [Enterprise ATT&CK Matrix](https://attack.mitre.org/matrices/enterprise/)

The articles in this category describe how to install the **MITRE ATT&CK**App via TC Exchange™, deploy the **MITRE ATT&CK**Source feed in ThreatConnect®, and view data created by the App.

NoteIf you are on a ThreatConnect instance with version 7.2 or newer installed and use the **MITRE ATT&CK** App version 2.0.3 or newer, the App will use system-generated [ATT&CK Tags](https://knowledge.threatconnect.com/docs/attack-tags) to identify techniques and sub-techniques associated with Intrusion Set, Malware, Tactic, and Tool Groups. This enables you to leverage the ThreatConnect [ATT&CK Visualizer](https://knowledge.threatconnect.com/docs/attack-visualizer) to further analyze the tactics, techniques, and procedures (TTPs) associated with Groups of those types.WarningBy default, the **MITRE ATT&CK 2.0.*x*** App overwrites all metadata (i.e., Attributes, Tags, Security Labels, Descriptions, etc.) for Groups in the selected owner that are included in the **MITRE ATT&CK** Source feed and deletes Groups that are *not*included in the Source feed when the corresponding Job runs. To prevent Groups that are not included in the **MITRE ATT&CK** Source feed from being deleted when the Job runs, set the Job's **Advanced Settings** parameter to **delete_enabled=false**, as detailed in [*MITRE ATT&CK Manual Job Configuration (Advanced Users Only)*](/v1/docs/mitre-attack-manual-job-configuration).

## Before You Start

| Minimum Role(s) | - System and Organization role of Read Only User for viewing data in the **MITRE ATT&CK**Source feed - System role of Administrator for installing the **MITRE ATT&CK 2.0.*x***App and deploying the **MITRE ATT&CK** Source feed - Organization role of Organization Administrator for creating and configuring a Job for the **MITRE ATT&CK** App in an Organization (advanced users only) - System role of Accounts Administrator for adding the **MITRE ATT&CK**Source to multiple Organizations |
| --- | --- |
| Prerequisites | None |

---

*ThreatConnect® is a registered trademark, and TC Exchange™ is a trademark, of ThreatConnect, Inc.* *MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation.*

20119-01 v.04.A

## Related

- [Applying Tags](/applying-tags.md)
- [Associations](/associations.md)
- [Copying a Group From a Community or Source](/copying-a-group-from-a-community-or-source.md)
- [Attributes](/attributes.md)
- [Ownership in ThreatConnect](/ownership-in-threatconnect.md)
- [The Details Screen](/the-details-screen.md)
- [The Feed Deployer](/the-feed-deployer.md)