CIS Controls for Threat Mitigations
CIS Controls for Threat Mitigations connects the security capabilities of the Center for Internet Security’s Critical Security Controls to …
October 27, 2022
Project Summary
Attack Flow is a data model with supporting tooling and examples for describing sequences of adversary behaviors. Attack flows help defenders understand, share, and make threat-informed decisions based on the sequence of actions in a cyber-attack. Flows can be analyzed to identify common patterns in adversary behavior, overlayed on ATT&CK Navigator layers to understand defensive coverage, and create a foundation for intel-driven adversary emulation plans.
This is an old version of the Attack Flow project. For the latest version, see: Attack Flow.
Problem
Defenders often track adversary behaviors atomically, focusing on one specific action at a time. This makes it harder to understand adversary attacks and to build effective defenses against those attacks.
Solution
Create a language, and associated tooling, to describe flows of ATT&CK techniques and combine those flows into patterns of behavior.
Impact
Help defenders and leaders understand how adversaries operate and compose atomic techniques into attacks to better understand defensive posture.
Project Resources:
Project Announcement Project Website GitHub Online Builder Current Release Downloads
Funding Research Participants
Non-Profit Participants
Explore More of Our Work:
Summiting the Pyramid
Summiting the Pyramid helps defenders measure the depth and quality of detection coverage beyond an ATT&CK heatmap. This release introduces …
Attack Flow
Attack Flow helps defenders capture the entire scope of a cyber attack and communicate what matters. By representing actions, conditions, and …
Stay Informed
Sign up for our "Stay Informed" mailing list to receive announcements for project publications, upcoming events, and other news about the Center.