{
"id": "MITRE ATT&CK",
"version": -1,
"fromVersion": "6.0.0",
"fromDate": "0001-01-01T00:00:00Z",
"toDate": "0001-01-01T00:00:00Z",
"period": {
"by": "",
"byTo": "",
"byFrom": "days",
"toValue": null,
"fromValue": 7,
"field": ""
},
"fromDateLicense": "0001-01-01T00:00:00Z",
"name": "MITRE IDs",
"description": "MITRE ATT&CK Dashboard",
"layout": [
{
"id": "9d62aab0-9dfc-11ea-86fe-fbb40ef53e2b",
"forceRange": false,
"x": 0,
"y": 0,
"i": "9d62aab0-9dfc-11ea-86fe-fbb40ef53e2b",
"w": 4,
"h": 3,
"widget": {
"id": "this-is-aest2",
"version": 1,
"modified": "2020-05-24T20:24:46.630583045Z",
"sortValues": null,
"propagationLabels": [
"all"
],
"vcShouldIgnore": false,
"commitMessage": "Widget imported",
"shouldCommit": true,
"name": "MITRE ATT&CK techniques by related Incidents",
"prevName": "Test 2",
"dataType": "indicators",
"widgetType": "bar",
"query": "type:\"MITRE ATT&CK\" and investigationsCount:>0 and -incident.type:\"MITRE ATT&CK CoA\"",
"sort": null,
"isPredefined": false,
"dateRange": {
"fromDate": "0001-01-01T00:00:00Z",
"toDate": "0001-01-01T00:00:00Z",
"period": {
"by": "",
"byTo": "",
"byFrom": "days",
"toValue": null,
"fromValue": 7,
"field": ""
},
"fromDateLicense": "0001-01-01T00:00:00Z"
},
"params": {
"groupBy": [
"name"
],
"keys": [
"sum|investigationsCount"
],
"tableColumns": [
{
"isDefault": true,
"key": "indicator_type",
"position": 1,
"width": 120
},
{
"isDefault": true,
"key": "value",
"position": 2,
"width": 300
},
{
"isDefault": true,
"key": "score",
"position": 4,
"width": 120
},
{
"isDefault": true,
"key": "firstSeen",
"position": 5,
"width": 275
},
{
"isDefault": true,
"key": "lastSeen",
"position": 6,
"width": 275
},
{
"isDefault": true,
"key": "timestamp",
"position": 8,
"width": 190
},
{
"isDefault": true,
"key": "relatedIncCount",
"position": 9,
"width": 150
},
{
"isDefault": true,
"key": "sourceBrands",
"position": 12,
"width": 175
},
{
"isDefault": true,
"key": "sourceInstances",
"position": 13,
"width": 175
},
{
"isDefault": true,
"key": "expirationStatus",
"position": 14,
"width": 175
},
{
"isDefault": true,
"key": "expiration",
"position": 15,
"width": 190
}
]
},
"size": 10,
"category": ""
}
},
{
"id": "8b8478b0-9f31-11ea-9d1e-efa455bba3f4",
"forceRange": true,
"x": 0,
"y": 3,
"i": "8b8478b0-9f31-11ea-9d1e-efa455bba3f4",
"w": 2,
"h": 1,
"widget": {
"id": "",
"version": 0,
"modified": "0001-01-01T00:00:00Z",
"sortValues": null,
"propagationLabels": [
"all"
],
"vcShouldIgnore": false,
"commitMessage": "",
"shouldCommit": false,
"name": "Initial Access",
"prevName": "",
"dataType": "incidents",
"widgetType": "number",
"query": "-status:closed -category:job -incident.type:\"MITRE ATT&CK CoA\" indicator.mitrekillchainphases.phase_name:\"initial-access\"",
"sort": null,
"isPredefined": false,
"dateRange": {
"fromDate": "0001-01-01T00:00:00Z",
"toDate": "0001-01-01T00:00:00Z",
"period": {
"by": "",
"byTo": "",
"byFrom": "days",
"toValue": null,
"fromValue": null,
"field": ""
},
"fromDateLicense": "0001-01-01T00:00:00Z"
},
"params": {
"colors": {
"isEnabled": true,
"items": {
"#00CD33": {
"value": 0
},
"#FAC100": {
"value": 5
},
"#FF1B15": {
"value": 10
}
},
"type": "above"
},
"tableColumns": [
{
"isDefault": true,
"key": "id",
"position": 0,
"width": 110
},
{
"isDefault": true,
"key": "name",
"position": 2,
"width": 300
},
{
"isDefault": true,
"key": "type",
"position": 3,
"width": 200
},
{
"isDefault": true,
"key": "severity",
"position": 4,
"width": 80
},
{
"isDefault": true,
"key": "status",
"position": 5,
"width": 80
},
{
"isDefault": true,
"key": "owner",
"position": 6,
"width": 160
},
{
"isDefault": true,
"key": "roles",
"position": 7,
"width": 160
},
{
"isDefault": true,
"key": "playbookId",
"position": 8,
"width": 150
},
{
"isDefault": true,
"key": "occurred",
"position": 9,
"width": 200
},
{
"isDefault": true,
"key": "dueDate",
"position": 10,
"width": 200
}
]
},
"size": 0,
"category": ""
}
},
{
"id": "34f20330-a348-11ea-a2b7-37dacd919b68",
"forceRange": false,
"x": 2,
"y": 3,
"i": "34f20330-a348-11ea-a2b7-37dacd919b68",
"w": 2,
"h": 1,
"widget": {
"id": "",
"version": 0,
"modified": "2020-05-18T15:27:26.583654737Z",
"sortValues": null,
"propagationLabels": [
"all"
],
"vcShouldIgnore": false,
"commitMessage": "",
"shouldCommit": false,
"name": "Execution",
"prevName": "Active Incidents - Pie chart",
"dataType": "incidents",
"widgetType": "number",
"query": "-status:closed -category:job -incident.type:\"MITRE ATT&CK CoA\" indicator.mitrekillchainphases.phase_name:\"execution\"",
"sort": null,
"isPredefined": false,
"dateRange": {
"fromDate": "0001-01-01T00:00:00Z",
"toDate": "0001-01-01T00:00:00Z",
"period": {
"by": "",
"byTo": "",
"byFrom": "days",
"toValue": null,
"fromValue": null,
"field": ""
},
"fromDateLicense": "0001-01-01T00:00:00Z"
},
"params": {
"colors": {
"isEnabled": true,
"items": {
"#00CD33": {
"value": 0
},
"#FAC100": {
"value": 5
},
"#FF1B15": {
"value": 10
}
},
"type": "above"
},
"tableColumns": [
{
"isDefault": true,
"key": "id",
"position": 0,
"width": 110
},
{
"isDefault": true,
"key": "name",
"position": 2,
"width": 300
},
{
"isDefault": true,
"key": "type",
"position": 3,
"width": 200
},
{
"isDefault": true,
"key": "severity",
"position": 4,
"width": 80
},
{
"isDefault": true,
"key": "status",
"position": 5,
"width": 80
},
{
"isDefault": true,
"key": "owner",
"position": 6,
"width": 160
},
{
"isDefault": true,
"key": "roles",
"position": 7,
"width": 160
},
{
"isDefault": true,
"key": "playbookId",
"position": 8,
"width": 150
},
{
"isDefault": true,
"key": "occurred",
"position": 9,
"width": 200
},
{
"isDefault": true,
"key": "dueDate",
"position": 10,
"width": 200
}
]
},
"size": 0,
"category": ""
}
},
{
"id": "673b1700-a348-11ea-a2b7-37dacd919b68",
"forceRange": false,
"x": 4,
"y": 3,
"i": "673b1700-a348-11ea-a2b7-37dacd919b68",
"w": 2,
"h": 1,
"widget": {
"id": "",
"version": 0,
"modified": "2020-05-18T15:27:26.583654737Z",
"sortValues": null,
"propagationLabels": [
"all"
],
"vcShouldIgnore": false,
"commitMessage": "",
"shouldCommit": false,
"name": "Persistence",
"prevName": "Active Incidents - Pie chart",
"dataType": "incidents",
"widgetType": "number",
"query": "-status:closed -category:job -incident.type:\"MITRE ATT&CK CoA\" indicator.mitrekillchainphases.phase_name:\"persistence\"",
"sort": null,
"isPredefined": false,
"dateRange": {
"fromDate": "0001-01-01T00:00:00Z",
"toDate": "0001-01-01T00:00:00Z",
"period": {
"by": "",
"byTo": "",
"byFrom": "days",
"toValue": null,
"fromValue": null,
"field": ""
},
"fromDateLicense": "0001-01-01T00:00:00Z"
},
"params": {
"colors": {
"isEnabled": true,
"items": {
"#00CD33": {
"value": 0
},
"#FAC100": {
"value": 5
},
"#FF1B15": {
"value": 10
}
},
"type": "above"
},
"tableColumns": [
{
"isDefault": true,
"key": "id",
"position": 0,
"width": 110
},
{
"isDefault": true,
"key": "name",
"position": 2,
"width": 300
},
{
"isDefault": true,
"key": "type",
"position": 3,
"width": 200
},
{
"isDefault": true,
"key": "severity",
"position": 4,
"width": 80
},
{
"isDefault": true,
"key": "status",
"position": 5,
"width": 80
},
{
"isDefault": true,
"key": "owner",
"position": 6,
"width": 160
},
{
"isDefault": true,
"key": "roles",
"position": 7,
"width": 160
},
{
"isDefault": true,
"key": "playbookId",
"position": 8,
"width": 150
},
{
"isDefault": true,
"key": "occurred",
"position": 9,
"width": 200
},
{
"isDefault": true,
"key": "dueDate",
"position": 10,
"width": 200
}
]
},
"size": 0,
"category": ""
}
},
{
"id": "85a61b90-a348-11ea-a2b7-37dacd919b68",
"forceRange": false,
"x": 6,
"y": 3,
"i": "85a61b90-a348-11ea-a2b7-37dacd919b68",
"w": 2,
"h": 1,
"widget": {
"id": "",
"version": 0,
"modified": "2020-05-18T15:27:26.583654737Z",
"sortValues": null,
"propagationLabels": [
"all"
],
"vcShouldIgnore": false,
"commitMessage": "",
"shouldCommit": false,
"name": "Privilege Escalation",
"prevName": "Active Incidents - Pie chart",
"dataType": "incidents",
"widgetType": "number",
"query": "-status:closed -category:job -incident.type:\"MITRE ATT&CK CoA\" indicator.mitrekillchainphases.phase_name:\"privilege-escalation\"",
"sort": null,
"isPredefined": false,
"dateRange": {
"fromDate": "0001-01-01T00:00:00Z",
"toDate": "0001-01-01T00:00:00Z",
"period": {
"by": "",
"byTo": "",
"byFrom": "days",
"toValue": null,
"fromValue": null,
"field": ""
},
"fromDateLicense": "0001-01-01T00:00:00Z"
},
"params": {
"colors": {
"isEnabled": true,
"items": {
"#00CD33": {
"value": 0
},
"#FAC100": {
"value": 5
},
"#FF1B15": {
"value": 10
}
},
"type": "above"
},
"tableColumns": [
{
"isDefault": true,
"key": "id",
"position": 0,
"width": 110
},
{
"isDefault": true,
"key": "name",
"position": 2,
"width": 300
},
{
"isDefault": true,
"key": "type",
"position": 3,
"width": 200
},
{
"isDefault": true,
"key": "severity",
"position": 4,
"width": 80
},
{
"isDefault": true,
"key": "status",
"position": 5,
"width": 80
},
{
"isDefault": true,
"key": "owner",
"position": 6,
"width": 160
},
{
"isDefault": true,
"key": "roles",
"position": 7,
"width": 160
},
{
"isDefault": true,
"key": "playbookId",
"position": 8,
"width": 150
},
{
"isDefault": true,
"key": "occurred",
"position": 9,
"width": 200
},
{
"isDefault": true,
"key": "dueDate",
"position": 10,
"width": 200
}
]
},
"size": 0,
"category": ""
}
},
{
"id": "a5d42ce0-a348-11ea-a2b7-37dacd919b68",
"forceRange": false,
"x": 8,
"y": 3,
"i": "a5d42ce0-a348-11ea-a2b7-37dacd919b68",
"w": 2,
"h": 1,
"widget": {
"id": "",
"version": 0,
"modified": "2020-05-18T15:27:26.485681085Z",
"sortValues": null,
"propagationLabels": [
"all"
],
"vcShouldIgnore": false,
"commitMessage": "",
"shouldCommit": false,
"name": "Defense Evasion",
"prevName": "Incidents in Error Run Status",
"dataType": "incidents",
"widgetType": "number",
"query": "-status:closed -category:job -incident.type:\"MITRE ATT&CK CoA\" indicator.mitrekillchainphases.phase_name:\"defense-evasion\"",
"sort": null,
"isPredefined": false,
"dateRange": {
"fromDate": "0001-01-01T00:00:00Z",
"toDate": "0001-01-01T00:00:00Z",
"period": {
"by": "",
"byTo": "",
"byFrom": "days",
"toValue": null,
"fromValue": null,
"field": ""
},
"fromDateLicense": "0001-01-01T00:00:00Z"
},
"params": {
"colors": {
"isEnabled": true,
"items": {
"#00CD33": {
"value": 0
},
"#FAC100": {
"value": 5
},
"#FF1B15": {
"value": 10
}
},
"type": "above"
}
},
"size": 0,
"category": ""
}
},
{
"id": "c81c1d80-a348-11ea-a2b7-37dacd919b68",
"forceRange": false,
"x": 10,
"y": 3,
"i": "c81c1d80-a348-11ea-a2b7-37dacd919b68",
"w": 2,
"h": 1,
"widget": {
"id": "",
"version": 0,
"modified": "2020-05-18T15:27:26.48442945Z",
"sortValues": null,
"propagationLabels": [
"all"
],
"vcShouldIgnore": false,
"commitMessage": "",
"shouldCommit": false,
"name": "Credential Access",
"prevName": "Incidents Dropped in Preprocessing",
"dataType": "audit",
"widgetType": "number",
"query": "-status:closed -category:job -incident.type:\"MITRE ATT&CK CoA\" indicator.mitrekillchainphases.phase_name:\"credential-access\"",
"sort": null,
"isPredefined": false,
"dateRange": {
"fromDate": "0001-01-01T00:00:00Z",
"toDate": "0001-01-01T00:00:00Z",
"period": {
"by": "",
"byTo": "",
"byFrom": "days",
"toValue": null,
"fromValue": null,
"field": ""
},
"fromDateLicense": "0001-01-01T00:00:00Z"
},
"params": {
"colors": {
"isEnabled": true,
"items": {
"#00CD33": {
"value": 0
},
"#FAC100": {
"value": 5
},
"#FF1B15": {
"value": 10
}
},
"type": "above"
},
"preProcessing": true
},
"size": 0,
"category": "incidents"
}
},
{
"id": "08cf87e0-a349-11ea-a2b7-37dacd919b68",
"forceRange": false,
"x": 0,
"y": 4,
"i": "08cf87e0-a349-11ea-a2b7-37dacd919b68",
"w": 2,
"h": 1,
"widget": {
"id": "",
"version": 0,
"modified": "2020-05-18T15:27:26.485681085Z",
"sortValues": null,
"propagationLabels": [
"all"
],
"vcShouldIgnore": false,
"commitMessage": "",
"shouldCommit": false,
"name": "Discovery",
"prevName": "Incidents in Error Run Status",
"dataType": "incidents",
"widgetType": "number",
"query": "-status:closed -category:job -incident.type:\"MITRE ATT&CK CoA\" indicator.mitrekillchainphases.phase_name:\"discovery\"",
"sort": null,
"isPredefined": false,
"dateRange": {
"fromDate": "0001-01-01T00:00:00Z",
"toDate": "0001-01-01T00:00:00Z",
"period": {
"by": "",
"byTo": "",
"byFrom": "days",
"toValue": null,
"fromValue": 7,
"field": ""
},
"fromDateLicense": "0001-01-01T00:00:00Z"
},
"params": {
"colors": {
"isEnabled": true,
"items": {
"#00CD33": {
"value": 0
},
"#FAC100": {
"value": 5
},
"#FF1B15": {
"value": 10
}
},
"type": "above"
}
},
"size": 0,
"category": ""
}
},
{
"id": "315ed4e0-a349-11ea-a2b7-37dacd919b68",
"forceRange": false,
"x": 2,
"y": 4,
"i": "315ed4e0-a349-11ea-a2b7-37dacd919b68",
"w": 2,
"h": 1,
"widget": {
"id": "",
"version": 0,
"modified": "2020-05-18T15:27:26.485681085Z",
"sortValues": null,
"propagationLabels": [
"all"
],
"vcShouldIgnore": false,
"commitMessage": "",
"shouldCommit": false,
"name": "Lateral Movement",
"prevName": "Incidents in Error Run Status",
"dataType": "incidents",
"widgetType": "number",
"query": "-status:closed -category:job -incident.type:\"MITRE ATT&CK CoA\" indicator.mitrekillchainphases.phase_name:\"lateral-movement\"",
"sort": null,
"isPredefined": false,
"dateRange": {
"fromDate": "0001-01-01T00:00:00Z",
"toDate": "0001-01-01T00:00:00Z",
"period": {
"by": "",
"byTo": "",
"byFrom": "days",
"toValue": null,
"fromValue": 7,
"field": ""
},
"fromDateLicense": "0001-01-01T00:00:00Z"
},
"params": {
"colors": {
"isEnabled": true,
"items": {
"#00CD33": {
"value": 0
},
"#FAC100": {
"value": 5
},
"#FF1B15": {
"value": 10
}
},
"type": "above"
}
},
"size": 0,
"category": ""
}
},
{
"id": "605dc6c0-a349-11ea-a2b7-37dacd919b68",
"forceRange": false,
"x": 4,
"y": 4,
"i": "605dc6c0-a349-11ea-a2b7-37dacd919b68",
"w": 2,
"h": 1,
"widget": {
"id": "",
"version": 0,
"modified": "2020-05-18T15:27:26.485681085Z",
"sortValues": null,
"propagationLabels": [
"all"
],
"vcShouldIgnore": false,
"commitMessage": "",
"shouldCommit": false,
"name": "Collection",
"prevName": "Incidents in Error Run Status",
"dataType": "incidents",
"widgetType": "number",
"query": "-status:closed -category:job -incident.type:\"MITRE ATT&CK CoA\" indicator.mitrekillchainphases.phase_name:\"collection\"",
"sort": null,
"isPredefined": false,
"dateRange": {
"fromDate": "0001-01-01T00:00:00Z",
"toDate": "0001-01-01T00:00:00Z",
"period": {
"by": "",
"byTo": "",
"byFrom": "days",
"toValue": null,
"fromValue": 7,
"field": ""
},
"fromDateLicense": "0001-01-01T00:00:00Z"
},
"params": {
"colors": {
"isEnabled": true,
"items": {
"#00CD33": {
"value": 0
},
"#FAC100": {
"value": 5
},
"#FF1B15": {
"value": 10
}
},
"type": "above"
}
},
"size": 0,
"category": ""
}
},
{
"id": "ce291380-a349-11ea-a2b7-37dacd919b68",
"forceRange": false,
"x": 6,
"y": 4,
"i": "ce291380-a349-11ea-a2b7-37dacd919b68",
"w": 2,
"h": 1,
"widget": {
"id": "",
"version": 0,
"modified": "2020-05-18T15:27:26.485681085Z",
"sortValues": null,
"propagationLabels": [
"all"
],
"vcShouldIgnore": false,
"commitMessage": "",
"shouldCommit": false,
"name": "Command and Control",
"prevName": "Incidents in Error Run Status",
"dataType": "incidents",
"widgetType": "number",
"query": "-status:closed -category:job -incident.type:\"MITRE ATT&CK CoA\" indicator.mitrekillchainphases.phase_name:\"command-and-control\"",
"sort": null,
"isPredefined": false,
"dateRange": {
"fromDate": "0001-01-01T00:00:00Z",
"toDate": "0001-01-01T00:00:00Z",
"period": {
"by": "",
"byTo": "",
"byFrom": "days",
"toValue": null,
"fromValue": 7,
"field": ""
},
"fromDateLicense": "0001-01-01T00:00:00Z"
},
"params": {
"colors": {
"isEnabled": true,
"items": {
"#00CD33": {
"value": 0
},
"#FAC100": {
"value": 5
},
"#FF1B15": {
"value": 10
}
},
"type": "above"
}
},
"size": 0,
"category": ""
}
},
{
"id": "0e3e4210-a34a-11ea-a2b7-37dacd919b68",
"forceRange": false,
"x": 8,
"y": 4,
"i": "0e3e4210-a34a-11ea-a2b7-37dacd919b68",
"w": 2,
"h": 1,
"widget": {
"id": "",
"version": 0,
"modified": "2020-05-18T15:27:26.578013345Z",
"sortValues": null,
"propagationLabels": [
"all"
],
"vcShouldIgnore": false,
"commitMessage": "",
"shouldCommit": false,
"name": "Exfiltration",
"prevName": "Late Incidents",
"dataType": "incidents",
"widgetType": "number",
"query": "-status:closed -category:job -incident.type:\"MITRE ATT&CK CoA\" indicator.mitrekillchainphases.phase_name:\"exfiltration\"",
"sort": null,
"isPredefined": false,
"dateRange": {
"fromDate": "0001-01-01T00:00:00Z",
"toDate": "0001-01-01T00:00:00Z",
"period": {
"by": "",
"byTo": "",
"byFrom": "days",
"toValue": null,
"fromValue": 7,
"field": ""
},
"fromDateLicense": "0001-01-01T00:00:00Z"
},
"params": {
"colors": {
"isEnabled": true,
"items": {
"#00CD33": {
"value": 0
},
"#FAC100": {
"value": 5
},
"#FF1B15": {
"value": 10
}
},
"type": "above"
}
},
"size": 0,
"category": ""
}
},
{
"id": "38d3bf50-a34a-11ea-a2b7-37dacd919b68",
"forceRange": false,
"x": 10,
"y": 4,
"i": "38d3bf50-a34a-11ea-a2b7-37dacd919b68",
"w": 2,
"h": 1,
"widget": {
"id": "",
"version": 0,
"modified": "2020-05-18T15:27:26.578013345Z",
"sortValues": null,
"propagationLabels": [
"all"
],
"vcShouldIgnore": false,
"commitMessage": "",
"shouldCommit": false,
"name": "Impact",
"prevName": "Late Incidents",
"dataType": "incidents",
"widgetType": "number",
"query": "-status:closed -category:job -incident.type:\"MITRE ATT&CK CoA\" indicator.mitrekillchainphases.phase_name:\"impact\"",
"sort": null,
"isPredefined": false,
"dateRange": {
"fromDate": "0001-01-01T00:00:00Z",
"toDate": "0001-01-01T00:00:00Z",
"period": {
"by": "",
"byTo": "",
"byFrom": "days",
"toValue": null,
"fromValue": 7,
"field": ""
},
"fromDateLicense": "0001-01-01T00:00:00Z"
},
"params": {
"colors": {
"isEnabled": true,
"items": {
"#00CD33": {
"value": 0
},
"#FAC100": {
"value": 5
},
"#FF1B15": {
"value": 10
}
},
"type": "above"
}
},
"size": 0,
"category": ""
}
},
{
"id": "d8de5460-a4d5-11ea-ac2f-65b884bb2f43",
"forceRange": false,
"x": 4,
"y": 0,
"i": "d8de5460-a4d5-11ea-ac2f-65b884bb2f43",
"w": 8,
"h": 3,
"widget": {
"id": "5add0cf9-010b-4e6b-8912-945fb49d7770",
"version": 1,
"modified": "2020-06-02T13:34:46.221937925Z",
"sortValues": null,
"propagationLabels": [
"all"
],
"vcShouldIgnore": false,
"commitMessage": "",
"shouldCommit": false,
"name": "MITRE ATT&CK techniques by related Incidents",
"prevName": "test",
"dataType": "scripts",
"widgetType": "text",
"query": "MITREIndicatorsByOpenIncidents",
"sort": null,
"isPredefined": false,
"dateRange": {
"fromDate": "0001-01-01T00:00:00Z",
"toDate": "0001-01-01T00:00:00Z",
"period": {
"by": "",
"byTo": "",
"byFrom": "days",
"toValue": null,
"fromValue": null,
"field": ""
},
"fromDateLicense": "0001-01-01T00:00:00Z"
},
"params": {
"tableColumns": []
},
"size": 0,
"category": ""
}
}
],
"isPredefined": true
}