--- title: "Visualizing ATT&CK Tactics, Techniques, and Sub-techniques" slug: "visualizing-attack-tactics-techniques-and-sub-techniques" description: "This article describes the ThreatConnect ATT&CK Visualizer layout and how to view details for specific techniques and sub-techniques." tags: ["Connecting Data", "Viewing Data"] updated: 2025-10-02T20:09:54Z published: 2025-10-02T20:09:54Z canonical: "knowledge.threatconnect.com/visualizing-attack-tactics-techniques-and-sub-techniques" --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # Visualizing ATT&CK Tactics, Techniques, and Sub-techniques ## Overview The ThreatConnect® ATT&CK® Visualizer displays all MITRE ATT&CK® [Enterprise](https://attack.mitre.org/matrices/enterprise/) [tactics](https://attack.mitre.org/tactics/enterprise/), [techniques, and sub-techniques](https://attack.mitre.org/techniques/enterprise/). As you select techniques and sub-techniques in the ATT&CK Visualizer, you can view more details about the selected items and see which Groups in your [ThreatConnect owners](https://knowledge.threatconnect.com/docs/ownership-in-threatconnect) are using them. This context allows you to gather insights into other Groups using similar tactics, techniques, and procedures (TTPs) and make informed decisions during an investigation involving the Groups. ## Before You Start ### User Roles - To access the ATT&CK Visualizer and view details for techniques and sub-techniques, your user account can have any [Organization role](https://knowledge.threatconnect.com/docs/organization-roles). ## ATT&CK Visualizer Layout Figure 1 illustrates how the ATT&CK Visualizer displays MITRE ATT&CK Enterprise tactics, techniques, and sub-techniques: ![Figure 1_Visualizing ATT&CK Tactics, Techniques, and Sub-techniques_7.10.2](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%201_Visualizing%20ATT&CK%20Tactics,%20Techniques,%20and%20Sub-techniques_7.10.2.png) 1. Each column represents a tactic (i.e., the goal a threat actor or adversary is trying to achieve) and displays the number of techniques that the tactic comprises. 2. Each card within a column represents a technique (i.e., the method a threat actor or adversary uses to achieve their goal) that the tactic comprises and displays the number of the technique’s sub-techniques. 3. If a technique has sub-techniques (i.e., more specific descriptions of the adversarial behavior used to achieve a goal), the technique card will contain a series of nested cards that represent the sub-techniques. To display a technique’s sub-techniques, click **Show sub-techniques![Show sub-techniques icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Show%20sub-techniques%20icon.png)**at the bottom of the technique.HintTo expand all techniques and display their sub-techniques, click **Expand All**at the upper right of the ATT&CK Visualizer. ## Viewing Details for Selected Techniques and Sub-techniques Selecting techniques and sub-techniques in the ATT&CK Visualizer opens the **Selection Details**drawer, which displays details about the selected items. The appearance of the **Selection Details**drawer depends on the number of items that are currently selected. When you select an individual technique or sub-technique, the **Selection Details**drawer opens automatically. You can also open the **Selection Details**drawer manually by clicking **View selection details![View%20selection%20details](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/View%20selection%20details.png)**at the upper right of the ATT&CK Visualizer or by selecting **View Selection Details**from the **Selection Actions**dropdown at the upper right of the ATT&CK Visualizer. ### Individual Technique or Sub-technique When only one technique or sub-technique is selected, the **Selection Details**drawer (Figure 2) displays the following details about the selected item: ![Figure 2_Visualizing ATT&CK Tactics, Techniques, and Sub-techniques_7.10.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%202_Visualizing%20ATT&CK%20Tactics,%20Techniques,%20and%20Sub-techniques_7.10.0.png) - **Technique**: The technique or sub-technique ID. - **Associated Tactics**: The tactics associated with the technique or sub-technique. - **Platform(s)**: The operating systems and applications associated with the technique or sub-technique. - **Sub-Techniques**: (Techniques only) The sub-techniques that the technique comprises. To open the **Selection Details**drawer for a sub-technique, click its name. - **Parent Technique**: (Sub-techniques only) The sub-technique’s parent technique. To open the **Selection Details**drawer for the parent technique, click its name. - **Groups using Technique**or **Groups using Sub-technique**: The number of Groups in your ThreatConnect owners that have an [ATT&CK Tag](https://knowledge.threatconnect.com/docs/attack-tags) corresponding to the technique or sub-technique applied to them. - **Financial Impact**: (Techniques only) The technique’s Financial Impact level, which is the relative amount of potential financial risk that the technique poses to your company. Financial Impact levels range from **$ (Very Low Potential Cost)** to **$$$$$ (Very High Potential Cost)**.NoteThe currency displayed in the **Financial Impact** field is selected by your Organization Administrator. If [ATT&CK RQ Financial Impact](https://knowledge.threatconnect.com/docs/attack-rq-financial-impact) is not configured for your Organization, the **Financial Impact**field will display no Financial Impact data. - **Description**: The description of the technique or sub-technique. To view the technique’s or sub-technique’s entry on the [MITRE ATT&CK website](https://attack.mitre.org/techniques/enterprise/), click **More information**at the bottom of this section. - **Groups**: The Groups in your ThreatConnect owners that have an ATT&CK Tag corresponding to the technique or sub-technique applied to them. If there are no such Groups, the **Selection Details**drawer will not display the **Groups**card. ### Multiple Techniques or Sub-techniques You can select multiple techniques and sub-techniques when viewing a [standard ATT&CK view](https://knowledge.threatconnect.com/docs/standard-attack-views) or [assigning security coverage for an Organization](https://knowledge.threatconnect.com/docs/attack-security-coverage). When multiple techniques or sub-techniques are selected, the **Selection Details** drawer (Figure 3) displays the following cards: ![Figure 3_Visualizing ATT&CK Tactics, Techniques, and Sub-techniques_7.10.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%203_Visualizing%20ATT&CK%20Tactics,%20Techniques,%20and%20Sub-techniques_7.10.0.png) - **Selections**: The **Selections**card displays all techniques and sub-techniques that are currently selected in the ATT&CK Visualizer and allows you to do the following: - **Clear an individual selection**: Click **Clear selection**![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Remove%20icon.png)on the right side of a technique’s or sub-technique’s row to deselect the technique or sub-technique. - **Clear all selections**: Click **Clear all selections**![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Remove%20icon.png)in the table header to deselect all techniques and sub-techniques that are currently selected. - **View more details about a technique or sub-technique**: Click a technique’s or sub-technique’s row to open its **Selection Details**drawer. To return to the **Selection**card, click **Go Back![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Go%20Back%20icon.png)**at the upper left of the **Selection Details**drawer. - **Shared Groups**: (Standard ATT&CK views only) The **Shared Groups** card displays the Groups in your ThreatConnect owners that have [ATT&CK Tags](https://knowledge.threatconnect.com/docs/attack-tags) corresponding to all selected techniques and sub-techniques applied to them. --- *ThreatConnect® is a registered trademark of ThreatConnect, Inc.* *MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation.* 20151-05 v.04.A