MITRE ATT&CK v2

Use the MITRE ATT&CK® feed to fetch MITRE’s Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) content. MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community.

Data Enrichment & Threat Intelligence · MITRE ATT&CK · Feed

Details

IDMITRE ATT&CK v2
ProviderMITRE Corporation
CategoryData Enrichment & Threat Intelligence
From Version5.5.0
Docker Imagedemisto/taxii2:1.0.0.7704170
Supported ModulesAgentix XSIAM EDR Cortex Cloud Cloud Runtime Security Attack Surface Management Cloud Posture Security Exposure Management

README

Use the MITRE ATT&CK Feed integration to fetch indicators from MITRE ATT&CK.
For more information click here.

Note: When upgrading from v1 (MITRE IDs Feed) to v2 (MITRE ATT&CK) - disabling the MITRE IDs Feed indicator type, and instance are important for the smooth flow of the upgrade.

Configure MITRE ATT&CK Feed in Cortex

Parameter Description Required
includeAPT This option will also create indicators using APT / actor name references if they are part of a MITRE Intrusion Set False
feedReputation The indicator reputation (defaults to ‘None’). False
feedReliability The source’s reliability. True
tlp_color The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed. More information about the protocol can be found at https://us-cert.cisa.gov/tlp False
feedExpirationPolicy The feed’s expiration policy. False
feedExpirationInterval The interval after which the feed expires. False
feedFetchInterval The feed fetch interval. False
feedBypassExclusionList Whether to bypass exclusion list. False
insecure Whether to trust any certificate (not secure). False
proxy Whether to use the system proxy settings. False
Create relationships Create relationships between indicators as part of Enrichment. False

Feed timeouts

MITRE enforce a rate limit for connecting to their taxii server. Ensure that your fetch interval is reasonable, otherwise you will receive connection errors.

Commands

You can execute these commands from the XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Get Indicators

Gets the indicators from MITRE ATT&CK.

Note: This command does not create indicators within Cortex XSOAR.

Base Command

mitre-get-indicators

Input
Argument Name Description Required
limit The maximum number of indicators to return. The default value is 10. Optional
raw Enabling raw will also output the raw content of each indicator Optional
Context Output

The context is output as:

  • MITRE (dict)
    • ATT&CK (list)

Each item in the “ATT&CK” list contains the following keys:

  • fields (any fields that the indicator will attempt to map into the indicator)
  • rawJSON (the raw JSON of the indicator)
  • score (the indicator score)
  • type (the type of indicator - will always be “MITRE ATT&CK”)
  • value (the indicator value, for example “T1134”)
Command Example

!mitre-get-indicators limit=2

Human Readable Output

MITRE ATT&CK Indicators

Value Score Type
T1531 0 MITRE ATT&CK
T1506 0 MITRE ATT&CK
Argument Name Description Required
indicator Indicator to lookup Required
Context Output

The context is output as:

  • DBotScore
  • MITRE (dict)
    • ATT&CK (list)

Each item in the “ATT&CK” list contains the customFields that are mapped into the indicator (each beginning with ‘mitre’)

MITRE Show Feeds

Displays the available feeds from the MITRE taxii service.

Base Command

mitre-show-feeds

Input

There are no inputs

Context Output

There is no context output

Command Example

!mitre-showfeeds

Human Readable Output

MITRE ATT&CK Feeds

Name ID
Enterprise ATT&CK 95ecc380-afe9-11e4-9b6c-751b66dd541e
PRE-ATT&CK 062767bd-02d2-4b72-84ba-56caef0f8658
Mobile ATT&CK 2f669986-b40b-4423-b720-4396ca6a462b

MITRE Get Indicator Name

Gets the Attack Pattern value from the Attack Pattern ID in the Enterprise collection only.

Base Command

mitre-get-indicator-name

Input
Argument Name Description Required
attack_ids The Attack Pattern IDs list True
Context Output
Path Type Description
MITREATTACK.id String MITRE ATTACK Attack Pattern ID.
MITREATTACK.value String MITRE ATTACK Attack Pattern value.
Command Example

!mitre-get-indicator-name attack_id=T1111

Human Readable Output

MITRE ATTACK Attack Patterns values

Attack ID Attack Value
T1111 Some Attack Value

attack-pattern

Looks up the reputation of the indicator in the Enterprise collection only.

Base Command

attack-pattern

Input

Argument Name Description Required
attack_pattern Indicator to look up. Required

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Score number The actual score.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
AttackPattern.STIXID string The STIX ID of the Attack Pattern.
AttackPattern.KillChainPhases string The kill chain phases of the Attack Pattern.
AttackPattern.FirstSeenBySource string The first seen by source of the Attack Pattern.
AttackPattern.Description string The description of the Attack Pattern.
AttackPattern.OperatingSystemRefs string The operating system references of the Attack Pattern.
AttackPattern.Publications string The publications of the Attack Pattern.
AttackPattern.MITREID string The MITRE ID of the Attack Pattern.
AttackPattern.Tags string The tags of the Attack Pattern.

Command Example

!attack-pattern attack_pattern="Search Threat Vendor Data"

Human Readable Output

MITRE ATTACK
Name: Search Threat Vendor Data - ID: T1681

Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations.

Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week. Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation.

This technique is distinct from Threat Intel Vendors in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information.

Troubleshooting

Rate-Limiting or IP Blocking Issues

Problem: You may encounter a “Too Many Requests” error for the URL https://attack-taxii.mitre.org/taxii2/ when accessing the MITRE ATT&CK API, because the MITRE ATT&CK API enforces rate limits and may block requests based on the IP address. This often occurs when multiple users or systems are making requests from the same IP address.

Solution: To resolve this issue, it is recommended to use a dedicated engine for your MITRE ATT&CK Feed integration. This will provide a unique IP address for the integration instance, preventing it from being blocked due to shared usage. Additionally, ensure that your fetch interval is set to a reasonable value to avoid exceeding the rate limits.

Configuration parameters

  • feed — Fetch indicators
  • feedReputation — Indicator Reputation
  • feedReliability — Source Reliability
  • tlp_color — Traffic Light Protocol Color
  • feedExpirationPolicy —
  • feedExpirationInterval —
  • feedFetchInterval — Feed Fetch Interval
  • feedTags — Tags
  • create_relationships — Create relationships
  • switch_intrusion_set_to_threat_actor — Save intrusion sets as threat actor indicator types
  • feedBypassExclusionList — Bypass exclusion list
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)

Commands (4)

  • attack-pattern

    Looks up the reputation of the indicator in the Enterprise collection only.

  • mitre-get-indicator-name

    Gets the Attack Pattern value from the Attack Pattern ID in the Enterprise collection only.

  • mitre-get-indicators

    Retrieves a limited number of indicators.

  • mitre-show-feeds

    Shows the feed names and IDs from TAXII.

Source

FeedMitreAttackv2.py FeedMitreAttackv2_test.py FeedMitreAttackv2.yml FeedMitreAttackv2_description.md
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: MITRE Corporation
sectionorder:
- Connect
- Collect
commonfields:
  id: MITRE ATT&CK v2
  version: -1
configuration:
- defaultvalue: 'true'
  display: Fetch indicators
  name: feed
  type: 8
  required: false
  section: Collect
- additionalinfo: Indicators from this integration instance will be marked with this reputation.
  display: Indicator Reputation
  name: feedReputation
  options:
  - None
  - Good
  - Suspicious
  - Bad
  type: 18
  required: false
  section: Collect
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: A - Completely reliable
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: false
  type: 15
  section: Collect
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.
  display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  required: false
  defaultvalue: WHITE
  section: Collect
- defaultvalue: indicatorType
  display: ''
  name: feedExpirationPolicy
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
  section: Collect
- defaultvalue: '20160'
  display: ''
  name: feedExpirationInterval
  type: 1
  required: false
  section: Collect
- defaultvalue: '1440'
  display: Feed Fetch Interval
  name: feedFetchInterval
  type: 19
  required: false
  section: Collect
- additionalinfo: Supports CSV values.
  display: Tags
  name: feedTags
  type: 0
  required: false
  section: Collect
- display: Create relationships
  name: create_relationships
  type: 8
  required: false
  defaultvalue: 'true'
  section: Collect
- defaultvalue: 'false'
  display: Save intrusion sets as threat actor indicator types
  name: switch_intrusion_set_to_threat_actor
  type: 8
  section: Collect
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
  defaultvalue: 'false'
  section: Collect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- defaultvalue: 'false'
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
description: Use the MITRE ATT&CK® feed to fetch MITRE’s Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) content. MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community.
display: MITRE ATT&CK
name: MITRE ATT&CK v2
script:
  commands:
  - arguments:
    - defaultValue: '10'
      description: The maximum number of indicators to return.
      name: limit
      required: true
    - auto: PREDEFINED
      defaultValue: 'False'
      description: Output in raw JSON format. Can be "True" or "False".
      name: raw
      predefined:
      - 'False'
      - 'True'
    description: Retrieves a limited number of indicators.
    name: mitre-get-indicators
  - description: Shows the feed names and IDs from TAXII.
    name: mitre-show-feeds
  - arguments:
    - default: true
      description: Indicator to look up.
      isArray: true
      name: attack_pattern
      required: true
    description: Looks up the reputation of the indicator in the Enterprise collection only.
    name: attack-pattern
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: AttackPattern.STIXID
      description: The STIX ID of the Attack Pattern.
      type: string
    - contextPath: AttackPattern.KillChainPhases
      description: The kill chain phases of the Attack Pattern.
      type: string
    - contextPath: AttackPattern.FirstSeenBySource
      description: The first seen by source of the Attack Pattern.
      type: string
    - contextPath: AttackPattern.Description
      description: The description of the Attack Pattern.
      type: string
    - contextPath: AttackPattern.OperatingSystemRefs
      description: The operating system references of the Attack Pattern.
      type: string
    - contextPath: AttackPattern.Publications
      description: The publications of the Attack Pattern.
      type: string
    - contextPath: AttackPattern.MITREID
      description: The MITRE ID of the Attack Pattern.
      type: string
    - contextPath: AttackPattern.Tags
      description: The tags of the Attack Pattern.
      type: string
  - arguments:
    - description: The Attack Pattern IDs list.
      isArray: true
      name: attack_ids
      required: true
    description: Gets the Attack Pattern value from the Attack Pattern ID in the Enterprise collection only.
    name: mitre-get-indicator-name
    outputs:
    - contextPath: MITREATTACK.id
      description: MITRE ATTACK Attack Pattern ID.
      type: String
    - contextPath: MITREATTACK.value
      description: MITRE ATTACK Attack Pattern value.
      type: String
  dockerimage: demisto/taxii2:1.0.0.7704170
  feed: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- FeedMitreAttackv2_test
fromversion: 5.5.0
autoUpdateDockerImage: false