MITRE ATT&CK® Technique

technique

The MITRE ATT&CK® Technique object describes the technique ID and/or name associated to an attack, as defined by ATT&CK® Matrix.

Contents

Attributes

Caption Name Type Is Array Default Description
Name name String The name of the attack technique, as defined by ATT&CK® Matrix. For example: Active Scanning.
Raw Data raw_data JSON The event data as received from the event source.
Record ID record_id String Unique identifier for the object
Source URL src_url URL String The versioned permalink of the attack technique, as defined by ATT&CK® Matrix. For example: https://attack.mitre.org/versions/v14/techniques/T1595/.
Unique ID uid String The unique identifier of the attack technique, as defined by ATT&CK® Matrix. For example: T1595.
Unmapped Data unmapped Unmapped The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.

References

Referenced By

Context

MITRE ATT&CK® Technique

JSON

            
{
  "caption": "MITRE ATT&CK\u00ae Technique",
  "description": "The MITRE ATT&CK\u00ae Technique object describes the technique ID and/or name associated to an attack, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK\u00ae Matrix</a>.",
  "extends": "_entity",
  "name": "technique",
  "attributes": {
    "name": {
      "description": "The name of the attack technique, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK\u00ae Matrix</a>. For example: <code>Active Scanning</code>.",
      "requirement": "recommended",
      "caption": "Name",
      "type": "string_t"
    },
    "src_url": {
      "description": "The versioned permalink of the attack technique, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK\u00ae Matrix</a>. For example: <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.",
      "requirement": "optional",
      "caption": "Source URL",
      "type": "url_t"
    },
    "uid": {
      "description": "The unique identifier of the attack technique, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK\u00ae Matrix</a>. For example: <code>T1595</code>.",
      "requirement": "recommended",
      "caption": "Unique ID",
      "type": "string_t"
    },
    "raw_data": {
      "group": "context",
      "caption": "Raw Data",
      "description": "The event data as received from the event source.",
      "type": "json_t"
    },
    "record_id": {
      "description": "Unique identifier for the object",
      "group": "primary",
      "requirement": "required",
      "caption": "Record ID",
      "type": "string_t"
    },
    "unmapped": {
      "caption": "Unmapped Data",
      "description": "The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.",
      "type": "unmapped",
      "is_array": true
    }
  },
  "constraints": {
    "at_least_one": [
      "name",
      "uid"
    ]
  }
}