MITRE ATT&CK®

attack

The MITRE ATT&CK® object describes the tactic, technique & sub-technique associated to an attack as defined in ATT&CK® Matrix.

Attributes

Caption	Name	Type	Description
Raw Data	`raw_data`	JSON	Group:`context` The event data as received from the event source.
Record ID	`record_id`	String	Group:`primary` Unique identifier for the object
Sub Technique	`sub_technique`	MITRE ATT&CK® Sub Technique[]	The Sub Technique object describes the sub technique ID and/or name associated to an attack, as defined by ATT&CK® Matrix.
Tactic	`tactic`	MITRE ATT&CK® Tactic[]	The Tactic object describes the tactic ID and/or name that is associated to an attack, as defined by ATT&CK® Matrix.
Tactics	`tactics`	MITRE ATT&CK® Tactic[]	The Tactic object describes the tactic ID and/or tactic name that are associated with the attack technique, as defined by ATT&CK® Matrix. 🚧 WARNING: DEPRECATED Tactics has been deprecated since 1.1.0. Use the `tactic` attribute instead.
Technique	`technique`	MITRE ATT&CK® Technique[]	The Technique object describes the technique ID and/or name associated to an attack, as defined by ATT&CK® Matrix.
Unmapped	`unmapped`	Unmapped[]	Data from the source that was not mapped into the schema.
Version	`version`	String	The ATT&CK® Matrix version.

These objects and events reference MITRE ATT&CK® in their attributes:

MITRE ATT&CK® references the following objects and events in its attributes:

This page describes ocsf-1.4.0

Updated 9 days ago