category: Data Enrichment & Threat Intelligence
provider: MITRE Corporation
sectionorder:
- Connect
- Collect
commonfields:
  id: MITRE ATT&CK v2
  version: -1
configuration:
- defaultvalue: 'true'
  display: Fetch indicators
  name: feed
  type: 8
  required: false
  section: Collect
- additionalinfo: Indicators from this integration instance will be marked with this reputation.
  display: Indicator Reputation
  name: feedReputation
  options:
  - None
  - Good
  - Suspicious
  - Bad
  type: 18
  required: false
  section: Collect
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: A - Completely reliable
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: false
  type: 15
  section: Collect
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.
  display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  required: false
  defaultvalue: WHITE
  section: Collect
- defaultvalue: indicatorType
  display: ''
  name: feedExpirationPolicy
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
  section: Collect
- defaultvalue: '20160'
  display: ''
  name: feedExpirationInterval
  type: 1
  required: false
  section: Collect
- defaultvalue: '1440'
  display: Feed Fetch Interval
  name: feedFetchInterval
  type: 19
  required: false
  section: Collect
- additionalinfo: Supports CSV values.
  display: Tags
  name: feedTags
  type: 0
  required: false
  section: Collect
- display: Create relationships
  name: create_relationships
  type: 8
  required: false
  defaultvalue: 'true'
  section: Collect
- defaultvalue: 'false'
  display: Save intrusion sets as threat actor indicator types
  name: switch_intrusion_set_to_threat_actor
  type: 8
  section: Collect
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
  defaultvalue: 'false'
  section: Collect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- defaultvalue: 'false'
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
description: Use the MITRE ATT&CK® feed to fetch MITRE’s Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) content. MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community.
display: MITRE ATT&CK
name: MITRE ATT&CK v2
script:
  commands:
  - arguments:
    - defaultValue: '10'
      description: The maximum number of indicators to return.
      name: limit
      required: true
    - auto: PREDEFINED
      defaultValue: 'False'
      description: Output in raw JSON format. Can be "True" or "False".
      name: raw
      predefined:
      - 'False'
      - 'True'
    description: Retrieves a limited number of indicators.
    name: mitre-get-indicators
  - description: Shows the feed names and IDs from TAXII.
    name: mitre-show-feeds
  - arguments:
    - default: true
      description: Indicator to look up.
      isArray: true
      name: attack_pattern
      required: true
    description: Looks up the reputation of the indicator in the Enterprise collection only.
    name: attack-pattern
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: AttackPattern.STIXID
      description: The STIX ID of the Attack Pattern.
      type: string
    - contextPath: AttackPattern.KillChainPhases
      description: The kill chain phases of the Attack Pattern.
      type: string
    - contextPath: AttackPattern.FirstSeenBySource
      description: The first seen by source of the Attack Pattern.
      type: string
    - contextPath: AttackPattern.Description
      description: The description of the Attack Pattern.
      type: string
    - contextPath: AttackPattern.OperatingSystemRefs
      description: The operating system references of the Attack Pattern.
      type: string
    - contextPath: AttackPattern.Publications
      description: The publications of the Attack Pattern.
      type: string
    - contextPath: AttackPattern.MITREID
      description: The MITRE ID of the Attack Pattern.
      type: string
    - contextPath: AttackPattern.Tags
      description: The tags of the Attack Pattern.
      type: string
  - arguments:
    - description: The Attack Pattern IDs list.
      isArray: true
      name: attack_ids
      required: true
    description: Gets the Attack Pattern value from the Attack Pattern ID in the Enterprise collection only.
    name: mitre-get-indicator-name
    outputs:
    - contextPath: MITREATTACK.id
      description: MITRE ATTACK Attack Pattern ID.
      type: String
    - contextPath: MITREATTACK.value
      description: MITRE ATTACK Attack Pattern value.
      type: String
  dockerimage: demisto/taxii2:1.0.0.7704170
  feed: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- FeedMitreAttackv2_test
fromversion: 5.5.0
autoUpdateDockerImage: false