Sensor Mappings to ATT&CK

December 10, 2023

Project Summary

Sensor Mappings to ATT&CK gives cyber defenders the information they need to identify and understand cyber incidents occurring in their environment. Various tools and services are available to collect system or network information, but it is not always clear how to use those tools to provide visibility into specific threats and adversarial behaviors occurring in their environment. These mappings between sensor events and ATT&CK data sources allows cyber defenders to create a more detailed picture of cyber incidents, including the threat actor, technical behavior, telemetry collection, and impact.

Problem

Cyber defenders need to connect which tools, capabilities, and events detect specific adversary behaviors.

Solution

Link adversary behaviors to defenders’ tools, capabilities, and sensors through ATT&CK Data Sources.

Impact

Defenders collect and analyze the data necessary to observe adversary behaviors.

Project Resources:

Project Announcement Project Website GitHub

---

Funding Research Participants

---

---

Non-Profit Participants

---