Mitre COA - MITRE Layout

Case Details

Notes

Linked Incidents

Child Incidents

Evidence

Team Members

Indicators

Timeline Information

Closing Information

Techniques to Handle

Handled Techniques

Work Plan

Handled Techniques

This section dynamically displays the handled techniques in a MITRE ATT&CK - Courses of Action investigation.

Techniques to Handle

This section dynamically displays the list of MITRE ATT&CK techniques that were not yet handled using the Courses of Action playbook.

1. Initial Access Remediation

Initial Access consists of techniques that use various entry vectors to gain their initial foothold within a network.

2. Execution Remediation

Execution consists of techniques that result in adversary-controlled code running on a local or remote system.

6. Credential Access Remediation

Credential Access consists of techniques for stealing credentials like account names and passwords.

5. Defense Evasion Remediation

Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise.

9. Collection Remediation

Collection consists of techniques adversaries may use to gather information and the sources information is collected from that are relevant to following through on the adversary’s objectives.

3. Persistence Remediation

Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access.

8. Lateral Movement Remediation

Lateral Movement consists of techniques that adversaries use to enter and control remote systems on a network.

7. Discovery Remediation

Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network.

4. Privilege Escalation Remediation

Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network.

12. Impact Remediation

Impact consists of techniques that adversaries use to disrupt availability or compromise integrity by manipulating business and operational processes.

11. Exfiltration Remediation

Exfiltration consists of techniques that adversaries may use to steal data from your network.

10. Command and Control Remediation

Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network.

Tab Description

Anti-Spyware Best Practices

You can attach an Anti-Spyware profile to a Security policy rule to detect connections initiated by spyware and command-and-control (C2) malware installed on systems on your network.

Anti-Spyware Best Practices

Anti-Spyware related passed BPA checks results.

Tab Description

WildFire Best Practices

Use a WildFire Analysis profile to specify for WildFire file analysis to be performed locally on the WildFire appliance or in the WildFire cloud. You can specify traffic to be forwarded to the public cloud or private cloud based on file type, application, or the transmission direction of the file (upload or download).

WildFire Best Practices

WildFire related passed BPA checks results.

Anti-Virus Best Practices

Use the Antivirus Profiles page to configure options to have the firewall scan for viruses on the defined traffic. Set the applications that should be inspected for viruses and the action to take when a virus is detected.

Anti-Virus Best Practices

Anti-Virus related passed BPA checks results.

File Blocking Best Practices

You can attach a File Blocking profile to a Security policy rule to block users from uploading or downloading specified file types or to generate an alert when a user attempts to upload or download specified file types.

File Blocking Best Practices

File Blocking related passed BPA checks results.

URL Filtering Best Practices

You can use URL filtering profiles to control access to web content.

URL Filtering Best Practices

URL Filtering related passed BPA checks results.

Vulnerability Protection Best Practices

A Security policy rule can include specification of a Vulnerability Protection profile that determines the level of protection against buffer overflows, illegal code execution, and other attempts to exploit system vulnerabilities.

Vulnerability Protection Best Practices

Vulnerability Protection related passed BPA checks results.

New Section

Anti-Spyware related failed BPA checks results.

New Section

Anti-Virus related failed BPA checks results.

New Section

File Blocking related failed BPA checks results.

New Section

URL Filtering related failed BPA checks results.

New Section

Vulnerability Protection related failed BPA checks results.

New Section

WildFire related failed BPA checks results.