MITRE ATT&CK® Sub Technique

sub_technique

The MITRE ATT&CK® Sub Technique object describes the sub technique ID and/or name associated to an attack, as defined by ATT&CK® Matrix.

Contents

Attributes

Caption Name Type Is Array Default Description
Name name String The name of the attack sub technique, as defined by ATT&CK® Matrix. For example: Scanning IP Blocks.
Raw Data raw_data JSON The event data as received from the event source.
Record ID record_id String Unique identifier for the object
Source URL src_url URL String The versioned permalink of the attack sub technique, as defined by ATT&CK® Matrix. For example: https://attack.mitre.org/versions/v14/techniques/T1595/001/.
Unique ID uid String The unique identifier of the attack sub technique, as defined by ATT&CK® Matrix. For example: T1595.001.
Unmapped Data unmapped Unmapped The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.

References

Referenced By

Context

MITRE ATT&CK® Sub Technique

JSON

            
{
  "caption": "MITRE ATT&CK\u00ae Sub Technique",
  "description": "The MITRE ATT&CK\u00ae Sub Technique object describes the sub technique ID and/or name associated to an attack, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK\u00ae Matrix</a>.",
  "extends": "_entity",
  "name": "sub_technique",
  "attributes": {
    "name": {
      "description": "The name of the attack sub technique, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK\u00ae Matrix</a>. For example: <code>Scanning IP Blocks</code>.",
      "requirement": "optional",
      "caption": "Name",
      "type": "string_t"
    },
    "src_url": {
      "description": "The versioned permalink of the attack sub technique, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK\u00ae Matrix</a>. For example: <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.",
      "requirement": "optional",
      "caption": "Source URL",
      "type": "url_t"
    },
    "uid": {
      "description": "The unique identifier of the attack sub technique, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK\u00ae Matrix</a>. For example: <code>T1595.001</code>.",
      "requirement": "recommended",
      "caption": "Unique ID",
      "type": "string_t"
    },
    "raw_data": {
      "group": "context",
      "caption": "Raw Data",
      "description": "The event data as received from the event source.",
      "type": "json_t"
    },
    "record_id": {
      "description": "Unique identifier for the object",
      "group": "primary",
      "requirement": "required",
      "caption": "Record ID",
      "type": "string_t"
    },
    "unmapped": {
      "caption": "Unmapped Data",
      "description": "The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.",
      "type": "unmapped",
      "is_array": true
    }
  },
  "constraints": {
    "at_least_one": [
      "name",
      "uid"
    ]
  }
}