Skip to main content

Mitre Attack

Threat Intelligence

The MITRE ATT&CK Connector fetches and synchronizes offensive security data from the MITRE ATT&CK framework. It reads the official MITRE ATT&CK data published in STIX 2.1 format from the public attack-stix-data repository, discovers the available collections (Enterprise, Mobile, ICS) from the repository index, and processes the STIX objects into Brinqa Data Model objects. STIX relationship objects are loaded into an in-memory relationship store and used to enrich each object with correlation attributes (parent/child techniques, mitigations, threat groups, malware, tools, and campaigns).

Data retrieved from Mitre Attack​

Connector ObjectRequiredMaps to Data Model
Attack PatternYesMitre Attack Pattern
Attack TacticYesAttack Tactic
Attack Threat GroupYesAttack Threat Group
Attack MalwareYesAttack Malware
Attack ToolYesAttack Tool
Attack CampaignYesAttack Campaign
Attack MitigationYesAttack Mitigation

Model relationships​

note

For detailed steps on how to view the data retrieved from Mitre Attack in the Brinqa Platform, see How to view your data.

Last updated on