{ "id": "MITRE ATT&CK", "version": -1, "fromVersion": "6.0.0", "fromDate": "0001-01-01T00:00:00Z", "toDate": "0001-01-01T00:00:00Z", "period": { "by": "", "byTo": "", "byFrom": "days", "toValue": null, "fromValue": 7, "field": "" }, "fromDateLicense": "0001-01-01T00:00:00Z", "name": "MITRE IDs", "description": "MITRE ATT&CK Dashboard", "layout": [ { "id": "9d62aab0-9dfc-11ea-86fe-fbb40ef53e2b", "forceRange": false, "x": 0, "y": 0, "i": "9d62aab0-9dfc-11ea-86fe-fbb40ef53e2b", "w": 4, "h": 3, "widget": { "id": "this-is-aest2", "version": 1, "modified": "2020-05-24T20:24:46.630583045Z", "sortValues": null, "propagationLabels": [ "all" ], "vcShouldIgnore": false, "commitMessage": "Widget imported", "shouldCommit": true, "name": "MITRE ATT&CK techniques by related Incidents", "prevName": "Test 2", "dataType": "indicators", "widgetType": "bar", "query": "type:\"MITRE ATT&CK\" and investigationsCount:>0 and -incident.type:\"MITRE ATT&CK CoA\"", "sort": null, "isPredefined": false, "dateRange": { "fromDate": "0001-01-01T00:00:00Z", "toDate": "0001-01-01T00:00:00Z", "period": { "by": "", "byTo": "", "byFrom": "days", "toValue": null, "fromValue": 7, "field": "" }, "fromDateLicense": "0001-01-01T00:00:00Z" }, "params": { "groupBy": [ "name" ], "keys": [ "sum|investigationsCount" ], "tableColumns": [ { "isDefault": true, "key": "indicator_type", "position": 1, "width": 120 }, { "isDefault": true, "key": "value", "position": 2, "width": 300 }, { "isDefault": true, "key": "score", "position": 4, "width": 120 }, { "isDefault": true, "key": "firstSeen", "position": 5, "width": 275 }, { "isDefault": true, "key": "lastSeen", "position": 6, "width": 275 }, { "isDefault": true, "key": "timestamp", "position": 8, "width": 190 }, { "isDefault": true, "key": "relatedIncCount", "position": 9, "width": 150 }, { "isDefault": true, "key": "sourceBrands", "position": 12, "width": 175 }, { "isDefault": true, "key": "sourceInstances", "position": 13, "width": 175 }, { "isDefault": true, "key": "expirationStatus", "position": 14, "width": 175 }, { "isDefault": true, "key": "expiration", "position": 15, "width": 190 } ] }, "size": 10, "category": "" } }, { "id": "8b8478b0-9f31-11ea-9d1e-efa455bba3f4", "forceRange": true, "x": 0, "y": 3, "i": "8b8478b0-9f31-11ea-9d1e-efa455bba3f4", "w": 2, "h": 1, "widget": { "id": "", "version": 0, "modified": "0001-01-01T00:00:00Z", "sortValues": null, "propagationLabels": [ "all" ], "vcShouldIgnore": false, "commitMessage": "", "shouldCommit": false, "name": "Initial Access", "prevName": "", "dataType": "incidents", "widgetType": "number", "query": "-status:closed -category:job -incident.type:\"MITRE ATT&CK CoA\" indicator.mitrekillchainphases.phase_name:\"initial-access\"", "sort": null, "isPredefined": false, "dateRange": { "fromDate": "0001-01-01T00:00:00Z", "toDate": "0001-01-01T00:00:00Z", "period": { "by": "", "byTo": "", "byFrom": "days", "toValue": null, "fromValue": null, "field": "" }, "fromDateLicense": "0001-01-01T00:00:00Z" }, "params": { "colors": { "isEnabled": true, "items": { "#00CD33": { "value": 0 }, "#FAC100": { "value": 5 }, "#FF1B15": { "value": 10 } }, "type": "above" }, "tableColumns": [ { "isDefault": true, "key": "id", "position": 0, "width": 110 }, { "isDefault": true, "key": "name", "position": 2, "width": 300 }, { "isDefault": true, "key": "type", "position": 3, "width": 200 }, { "isDefault": true, "key": "severity", "position": 4, "width": 80 }, { "isDefault": true, "key": "status", "position": 5, "width": 80 }, { "isDefault": true, "key": "owner", "position": 6, "width": 160 }, { "isDefault": true, "key": "roles", "position": 7, "width": 160 }, { "isDefault": true, "key": "playbookId", "position": 8, "width": 150 }, { "isDefault": true, "key": "occurred", "position": 9, "width": 200 }, { "isDefault": true, "key": "dueDate", "position": 10, "width": 200 } ] }, "size": 0, "category": "" } }, { "id": "34f20330-a348-11ea-a2b7-37dacd919b68", "forceRange": false, "x": 2, "y": 3, "i": "34f20330-a348-11ea-a2b7-37dacd919b68", "w": 2, "h": 1, "widget": { "id": "", "version": 0, "modified": "2020-05-18T15:27:26.583654737Z", "sortValues": null, "propagationLabels": [ "all" ], "vcShouldIgnore": false, "commitMessage": "", "shouldCommit": false, "name": "Execution", "prevName": "Active Incidents - Pie chart", "dataType": "incidents", "widgetType": "number", "query": "-status:closed -category:job -incident.type:\"MITRE ATT&CK CoA\" indicator.mitrekillchainphases.phase_name:\"execution\"", "sort": null, "isPredefined": false, "dateRange": { "fromDate": "0001-01-01T00:00:00Z", "toDate": "0001-01-01T00:00:00Z", "period": { "by": "", "byTo": "", "byFrom": "days", "toValue": null, "fromValue": null, "field": "" }, "fromDateLicense": "0001-01-01T00:00:00Z" }, "params": { "colors": { "isEnabled": true, "items": { "#00CD33": { "value": 0 }, "#FAC100": { "value": 5 }, "#FF1B15": { "value": 10 } }, "type": "above" }, "tableColumns": [ { "isDefault": true, "key": "id", "position": 0, "width": 110 }, { "isDefault": true, "key": "name", "position": 2, "width": 300 }, { "isDefault": true, "key": "type", "position": 3, "width": 200 }, { "isDefault": true, "key": "severity", "position": 4, "width": 80 }, { "isDefault": true, "key": "status", "position": 5, "width": 80 }, { "isDefault": true, "key": "owner", "position": 6, "width": 160 }, { "isDefault": true, "key": "roles", "position": 7, "width": 160 }, { "isDefault": true, "key": "playbookId", "position": 8, "width": 150 }, { "isDefault": true, "key": "occurred", "position": 9, "width": 200 }, { "isDefault": true, "key": "dueDate", "position": 10, "width": 200 } ] }, "size": 0, "category": "" } }, { "id": "673b1700-a348-11ea-a2b7-37dacd919b68", "forceRange": false, "x": 4, "y": 3, "i": "673b1700-a348-11ea-a2b7-37dacd919b68", "w": 2, "h": 1, "widget": { "id": "", "version": 0, "modified": "2020-05-18T15:27:26.583654737Z", "sortValues": null, "propagationLabels": [ "all" ], "vcShouldIgnore": false, "commitMessage": "", "shouldCommit": false, "name": "Persistence", "prevName": "Active Incidents - Pie chart", "dataType": "incidents", "widgetType": "number", "query": "-status:closed -category:job -incident.type:\"MITRE ATT&CK CoA\" indicator.mitrekillchainphases.phase_name:\"persistence\"", "sort": null, "isPredefined": false, "dateRange": { "fromDate": "0001-01-01T00:00:00Z", "toDate": "0001-01-01T00:00:00Z", "period": { "by": "", "byTo": "", "byFrom": "days", "toValue": null, "fromValue": null, "field": "" }, "fromDateLicense": "0001-01-01T00:00:00Z" }, "params": { "colors": { "isEnabled": true, "items": { "#00CD33": { "value": 0 }, "#FAC100": { "value": 5 }, "#FF1B15": { "value": 10 } }, "type": "above" }, "tableColumns": [ { "isDefault": true, "key": "id", "position": 0, "width": 110 }, { "isDefault": true, "key": "name", "position": 2, "width": 300 }, { "isDefault": true, "key": "type", "position": 3, "width": 200 }, { "isDefault": true, "key": "severity", "position": 4, "width": 80 }, { "isDefault": true, "key": "status", "position": 5, "width": 80 }, { "isDefault": true, "key": "owner", "position": 6, "width": 160 }, { "isDefault": true, "key": "roles", "position": 7, "width": 160 }, { "isDefault": true, "key": "playbookId", "position": 8, "width": 150 }, { "isDefault": true, "key": "occurred", "position": 9, "width": 200 }, { "isDefault": true, "key": "dueDate", "position": 10, "width": 200 } ] }, "size": 0, "category": "" } }, { "id": "85a61b90-a348-11ea-a2b7-37dacd919b68", "forceRange": false, "x": 6, "y": 3, "i": "85a61b90-a348-11ea-a2b7-37dacd919b68", "w": 2, "h": 1, "widget": { "id": "", "version": 0, "modified": "2020-05-18T15:27:26.583654737Z", "sortValues": null, "propagationLabels": [ "all" ], "vcShouldIgnore": false, "commitMessage": "", "shouldCommit": false, "name": "Privilege Escalation", "prevName": "Active Incidents - Pie chart", "dataType": "incidents", "widgetType": "number", "query": "-status:closed -category:job -incident.type:\"MITRE ATT&CK CoA\" indicator.mitrekillchainphases.phase_name:\"privilege-escalation\"", "sort": null, "isPredefined": false, "dateRange": { "fromDate": "0001-01-01T00:00:00Z", "toDate": "0001-01-01T00:00:00Z", "period": { "by": "", "byTo": "", "byFrom": "days", "toValue": null, "fromValue": null, "field": "" }, "fromDateLicense": "0001-01-01T00:00:00Z" }, "params": { "colors": { "isEnabled": true, "items": { "#00CD33": { "value": 0 }, "#FAC100": { "value": 5 }, "#FF1B15": { "value": 10 } }, "type": "above" }, "tableColumns": [ { "isDefault": true, "key": "id", "position": 0, "width": 110 }, { "isDefault": true, "key": "name", "position": 2, "width": 300 }, { "isDefault": true, "key": "type", "position": 3, "width": 200 }, { "isDefault": true, "key": "severity", "position": 4, "width": 80 }, { "isDefault": true, "key": "status", "position": 5, "width": 80 }, { "isDefault": true, "key": "owner", "position": 6, "width": 160 }, { "isDefault": true, "key": "roles", "position": 7, "width": 160 }, { "isDefault": true, "key": "playbookId", "position": 8, "width": 150 }, { "isDefault": true, "key": "occurred", "position": 9, "width": 200 }, { "isDefault": true, "key": "dueDate", "position": 10, "width": 200 } ] }, "size": 0, "category": "" } }, { "id": "a5d42ce0-a348-11ea-a2b7-37dacd919b68", "forceRange": false, "x": 8, "y": 3, "i": "a5d42ce0-a348-11ea-a2b7-37dacd919b68", "w": 2, "h": 1, "widget": { "id": "", "version": 0, "modified": "2020-05-18T15:27:26.485681085Z", "sortValues": null, "propagationLabels": [ "all" ], "vcShouldIgnore": false, "commitMessage": "", "shouldCommit": false, "name": "Defense Evasion", "prevName": "Incidents in Error Run Status", "dataType": "incidents", "widgetType": "number", "query": "-status:closed -category:job -incident.type:\"MITRE ATT&CK CoA\" indicator.mitrekillchainphases.phase_name:\"defense-evasion\"", "sort": null, "isPredefined": false, "dateRange": { "fromDate": "0001-01-01T00:00:00Z", "toDate": "0001-01-01T00:00:00Z", "period": { "by": "", "byTo": "", "byFrom": "days", "toValue": null, "fromValue": null, "field": "" }, "fromDateLicense": "0001-01-01T00:00:00Z" }, "params": { "colors": { "isEnabled": true, "items": { "#00CD33": { "value": 0 }, "#FAC100": { "value": 5 }, "#FF1B15": { "value": 10 } }, "type": "above" } }, "size": 0, "category": "" } }, { "id": "c81c1d80-a348-11ea-a2b7-37dacd919b68", "forceRange": false, "x": 10, "y": 3, "i": "c81c1d80-a348-11ea-a2b7-37dacd919b68", "w": 2, "h": 1, "widget": { "id": "", "version": 0, "modified": "2020-05-18T15:27:26.48442945Z", "sortValues": null, "propagationLabels": [ "all" ], "vcShouldIgnore": false, "commitMessage": "", "shouldCommit": false, "name": "Credential Access", "prevName": "Incidents Dropped in Preprocessing", "dataType": "audit", "widgetType": "number", "query": "-status:closed -category:job -incident.type:\"MITRE ATT&CK CoA\" indicator.mitrekillchainphases.phase_name:\"credential-access\"", "sort": null, "isPredefined": false, "dateRange": { "fromDate": "0001-01-01T00:00:00Z", "toDate": "0001-01-01T00:00:00Z", "period": { "by": "", "byTo": "", "byFrom": "days", "toValue": null, "fromValue": null, "field": "" }, "fromDateLicense": "0001-01-01T00:00:00Z" }, "params": { "colors": { "isEnabled": true, "items": { "#00CD33": { "value": 0 }, "#FAC100": { "value": 5 }, "#FF1B15": { "value": 10 } }, "type": "above" }, "preProcessing": true }, "size": 0, "category": "incidents" } }, { "id": "08cf87e0-a349-11ea-a2b7-37dacd919b68", "forceRange": false, "x": 0, "y": 4, "i": "08cf87e0-a349-11ea-a2b7-37dacd919b68", "w": 2, "h": 1, "widget": { "id": "", "version": 0, "modified": "2020-05-18T15:27:26.485681085Z", "sortValues": null, "propagationLabels": [ "all" ], "vcShouldIgnore": false, "commitMessage": "", "shouldCommit": false, "name": "Discovery", "prevName": "Incidents in Error Run Status", "dataType": "incidents", "widgetType": "number", "query": "-status:closed -category:job -incident.type:\"MITRE ATT&CK CoA\" indicator.mitrekillchainphases.phase_name:\"discovery\"", "sort": null, "isPredefined": false, "dateRange": { "fromDate": "0001-01-01T00:00:00Z", "toDate": "0001-01-01T00:00:00Z", "period": { "by": "", "byTo": "", "byFrom": "days", "toValue": null, "fromValue": 7, "field": "" }, "fromDateLicense": "0001-01-01T00:00:00Z" }, "params": { "colors": { "isEnabled": true, "items": { "#00CD33": { "value": 0 }, "#FAC100": { "value": 5 }, "#FF1B15": { "value": 10 } }, "type": "above" } }, "size": 0, "category": "" } }, { "id": "315ed4e0-a349-11ea-a2b7-37dacd919b68", "forceRange": false, "x": 2, "y": 4, "i": "315ed4e0-a349-11ea-a2b7-37dacd919b68", "w": 2, "h": 1, "widget": { "id": "", "version": 0, "modified": "2020-05-18T15:27:26.485681085Z", "sortValues": null, "propagationLabels": [ "all" ], "vcShouldIgnore": false, "commitMessage": "", "shouldCommit": false, "name": "Lateral Movement", "prevName": "Incidents in Error Run Status", "dataType": "incidents", "widgetType": "number", "query": "-status:closed -category:job -incident.type:\"MITRE ATT&CK CoA\" indicator.mitrekillchainphases.phase_name:\"lateral-movement\"", "sort": null, "isPredefined": false, "dateRange": { "fromDate": "0001-01-01T00:00:00Z", "toDate": "0001-01-01T00:00:00Z", "period": { "by": "", "byTo": "", "byFrom": "days", "toValue": null, "fromValue": 7, "field": "" }, "fromDateLicense": "0001-01-01T00:00:00Z" }, "params": { "colors": { "isEnabled": true, "items": { "#00CD33": { "value": 0 }, "#FAC100": { "value": 5 }, "#FF1B15": { "value": 10 } }, "type": "above" } }, "size": 0, "category": "" } }, { "id": "605dc6c0-a349-11ea-a2b7-37dacd919b68", "forceRange": false, "x": 4, "y": 4, "i": "605dc6c0-a349-11ea-a2b7-37dacd919b68", "w": 2, "h": 1, "widget": { "id": "", "version": 0, "modified": "2020-05-18T15:27:26.485681085Z", "sortValues": null, "propagationLabels": [ "all" ], "vcShouldIgnore": false, "commitMessage": "", "shouldCommit": false, "name": "Collection", "prevName": "Incidents in Error Run Status", "dataType": "incidents", "widgetType": "number", "query": "-status:closed -category:job -incident.type:\"MITRE ATT&CK CoA\" indicator.mitrekillchainphases.phase_name:\"collection\"", "sort": null, "isPredefined": false, "dateRange": { "fromDate": "0001-01-01T00:00:00Z", "toDate": "0001-01-01T00:00:00Z", "period": { "by": "", "byTo": "", "byFrom": "days", "toValue": null, "fromValue": 7, "field": "" }, "fromDateLicense": "0001-01-01T00:00:00Z" }, "params": { "colors": { "isEnabled": true, "items": { "#00CD33": { "value": 0 }, "#FAC100": { "value": 5 }, "#FF1B15": { "value": 10 } }, "type": "above" } }, "size": 0, "category": "" } }, { "id": "ce291380-a349-11ea-a2b7-37dacd919b68", "forceRange": false, "x": 6, "y": 4, "i": "ce291380-a349-11ea-a2b7-37dacd919b68", "w": 2, "h": 1, "widget": { "id": "", "version": 0, "modified": "2020-05-18T15:27:26.485681085Z", "sortValues": null, "propagationLabels": [ "all" ], "vcShouldIgnore": false, "commitMessage": "", "shouldCommit": false, "name": "Command and Control", "prevName": "Incidents in Error Run Status", "dataType": "incidents", "widgetType": "number", "query": "-status:closed -category:job -incident.type:\"MITRE ATT&CK CoA\" indicator.mitrekillchainphases.phase_name:\"command-and-control\"", "sort": null, "isPredefined": false, "dateRange": { "fromDate": "0001-01-01T00:00:00Z", "toDate": "0001-01-01T00:00:00Z", "period": { "by": "", "byTo": "", "byFrom": "days", "toValue": null, "fromValue": 7, "field": "" }, "fromDateLicense": "0001-01-01T00:00:00Z" }, "params": { "colors": { "isEnabled": true, "items": { "#00CD33": { "value": 0 }, "#FAC100": { "value": 5 }, "#FF1B15": { "value": 10 } }, "type": "above" } }, "size": 0, "category": "" } }, { "id": "0e3e4210-a34a-11ea-a2b7-37dacd919b68", "forceRange": false, "x": 8, "y": 4, "i": "0e3e4210-a34a-11ea-a2b7-37dacd919b68", "w": 2, "h": 1, "widget": { "id": "", "version": 0, "modified": "2020-05-18T15:27:26.578013345Z", "sortValues": null, "propagationLabels": [ "all" ], "vcShouldIgnore": false, "commitMessage": "", "shouldCommit": false, "name": "Exfiltration", "prevName": "Late Incidents", "dataType": "incidents", "widgetType": "number", "query": "-status:closed -category:job -incident.type:\"MITRE ATT&CK CoA\" indicator.mitrekillchainphases.phase_name:\"exfiltration\"", "sort": null, "isPredefined": false, "dateRange": { "fromDate": "0001-01-01T00:00:00Z", "toDate": "0001-01-01T00:00:00Z", "period": { "by": "", "byTo": "", "byFrom": "days", "toValue": null, "fromValue": 7, "field": "" }, "fromDateLicense": "0001-01-01T00:00:00Z" }, "params": { "colors": { "isEnabled": true, "items": { "#00CD33": { "value": 0 }, "#FAC100": { "value": 5 }, "#FF1B15": { "value": 10 } }, "type": "above" } }, "size": 0, "category": "" } }, { "id": "38d3bf50-a34a-11ea-a2b7-37dacd919b68", "forceRange": false, "x": 10, "y": 4, "i": "38d3bf50-a34a-11ea-a2b7-37dacd919b68", "w": 2, "h": 1, "widget": { "id": "", "version": 0, "modified": "2020-05-18T15:27:26.578013345Z", "sortValues": null, "propagationLabels": [ "all" ], "vcShouldIgnore": false, "commitMessage": "", "shouldCommit": false, "name": "Impact", "prevName": "Late Incidents", "dataType": "incidents", "widgetType": "number", "query": "-status:closed -category:job -incident.type:\"MITRE ATT&CK CoA\" indicator.mitrekillchainphases.phase_name:\"impact\"", "sort": null, "isPredefined": false, "dateRange": { "fromDate": "0001-01-01T00:00:00Z", "toDate": "0001-01-01T00:00:00Z", "period": { "by": "", "byTo": "", "byFrom": "days", "toValue": null, "fromValue": 7, "field": "" }, "fromDateLicense": "0001-01-01T00:00:00Z" }, "params": { "colors": { "isEnabled": true, "items": { "#00CD33": { "value": 0 }, "#FAC100": { "value": 5 }, "#FF1B15": { "value": 10 } }, "type": "above" } }, "size": 0, "category": "" } }, { "id": "d8de5460-a4d5-11ea-ac2f-65b884bb2f43", "forceRange": false, "x": 4, "y": 0, "i": "d8de5460-a4d5-11ea-ac2f-65b884bb2f43", "w": 8, "h": 3, "widget": { "id": "5add0cf9-010b-4e6b-8912-945fb49d7770", "version": 1, "modified": "2020-06-02T13:34:46.221937925Z", "sortValues": null, "propagationLabels": [ "all" ], "vcShouldIgnore": false, "commitMessage": "", "shouldCommit": false, "name": "MITRE ATT&CK techniques by related Incidents", "prevName": "test", "dataType": "scripts", "widgetType": "text", "query": "MITREIndicatorsByOpenIncidents", "sort": null, "isPredefined": false, "dateRange": { "fromDate": "0001-01-01T00:00:00Z", "toDate": "0001-01-01T00:00:00Z", "period": { "by": "", "byTo": "", "byFrom": "days", "toValue": null, "fromValue": null, "field": "" }, "fromDateLicense": "0001-01-01T00:00:00Z" }, "params": { "tableColumns": [] }, "size": 0, "category": "" } } ], "isPredefined": true }