| 1 | --- |
| 2 | title: MITRE ATT&CK integration |
| 3 | description: Technique-centric investigation and coverage lens powered by MITRE technique enrichment in Wazuh rules. |
| 4 | --- |
| 5 | |
| 6 | MITRE ATT&CK in CoPilot gives you a technique-centric lens across alerts/events. It’s useful for: |
| 7 | - coverage conversations (“what do we detect?”) |
| 8 | - investigation context (“what does this behavior usually mean?”) |
| 9 | - mapping detections to a globally recognized adversary behavior framework |
| 10 | |
| 11 |  |
| 12 | |
| 13 | --- |
| 14 | |
| 15 | ## What it is |
| 16 | |
| 17 | MITRE ATT&CK is a widely used framework that maps adversary behavior from **initial access** through **execution, persistence, lateral movement, and exfiltration**. |
| 18 | |
| 19 | In CoPilot, the MITRE ATT&CK view is built from **MITRE technique IDs attached to Wazuh rules**. |
| 20 | |
| 21 | Key idea: |
| 22 | - When a Wazuh rule fires and includes MITRE technique metadata, CoPilot can display that technique and group related events under it. |
| 23 | |
| 24 | --- |
| 25 | |
| 26 | ## Why this is a power feature |
| 27 | |
| 28 | Most SIEM alert views are “alert-first.” MITRE ATT&CK flips it to “behavior-first.” |
| 29 | |
| 30 | This helps: |
| 31 | - leadership and customers understand coverage in a standardized language |
| 32 | - analysts quickly interpret what a detection is *trying* to tell them |
| 33 | - detection engineers spot gaps (tactics/techniques you never hit) |
| 34 | |
| 35 | --- |
| 36 | |
| 37 | ## How technique enrichment works (Wazuh) |
| 38 | |
| 39 | Wazuh’s rule syntax supports attaching MITRE technique IDs to a rule. |
| 40 | |
| 41 | That means: |
| 42 | - default Wazuh rules can provide technique mappings |
| 43 | - your custom rules can also include technique IDs |
| 44 | - SOCFortress rules can include technique IDs as part of your tuned ruleset |
| 45 | |
| 46 | When those rules generate events, CoPilot can present them inside the MITRE ATT&CK experience. |
| 47 | |
| 48 | --- |
| 49 | |
| 50 | ## What you can do in the UI |
| 51 | |
| 52 | When you open a technique, CoPilot shows an overview page with: |
| 53 | - description |
| 54 | - references |
| 55 | - direct link out to the MITRE technique page |
| 56 | |
| 57 |  |
| 58 | |
| 59 | You can then pivot through supporting tabs such as: |
| 60 | - **Tactics** (the “why” / objectives) |
| 61 | - **Mitigations** (recommended controls) |
| 62 | - **Software** (tools/malware commonly associated) |
| 63 | - **Alerts / events** mapped to that technique |
| 64 | - **Atomic tests** (where available) to validate detections |
| 65 | |
| 66 |  |
| 67 | |
| 68 | --- |
| 69 | |
| 70 | ## Operator workflow (practical) |
| 71 | |
| 72 | Use MITRE ATT&CK when you want a fast interpretation loop: |
| 73 | |
| 74 | 1) Open **Alerts → MITRE ATT&CK** |
| 75 | 2) Pick a technique showing activity |
| 76 | 3) Review tactics/mitigations/software context |
| 77 | 4) Pivot into the linked alerts/events for the concrete evidence |
| 78 | 5) If you’re testing, run an Atomic test to validate end-to-end detection coverage |
| 79 | |
| 80 | --- |
| 81 | |
| 82 | ## Prerequisites |
| 83 | |
| 84 | - Wazuh detections are flowing into the stack |
| 85 | - Your Wazuh rules include MITRE technique IDs (default rules + your custom rules) |
| 86 | |
| 87 | --- |
| 88 | |
| 89 | ## Gotchas |
| 90 | |
| 91 | - MITRE mapping quality depends on rule metadata. If a rule has no technique ID, it won’t show up here. |
| 92 | - This view is best for context and coverage—not necessarily the primary incident queue. |
| 93 | |
| 94 | --- |
| 95 | |
| 96 | ## Where to find it |
| 97 | |
| 98 | - UI: [MITRE ATT&CK (alerts view)](/user/ui/alerts-mitre) |
| 99 | |
| 100 | --- |
| 101 | |
| 102 | ## Video context |
| 103 | |
| 104 | Walkthrough of the feature: |
| 105 | - https://www.youtube.com/watch?v=wK4aA7QrXmE |