Viewing the MITRE ATT&CK Matrix

To view the MITRE ATT&CK Matrix:

1. Click the Dashboard tab.
2. In the toolbar at the top left-side of the page, click Default Dashboard > MITRE ATT&CK Dashboard. Optionally, you can click Go to MITRE Coverage Dashboard in the MITRE ATT&CK widget in the Default Dashboard.
3. Click the Attack Behaviors drop-down at the top-right of the dashboard to filter the dashboard by behaviors:
   • All
   • Ransomware
   • Insider Threat
   • Cyber Espionage
4. Click a technique in the table. A pop-up window displays a summary of the technique.

   Tactic	The tactic of the behavior.
   Coverage	The coverage status of the technique and the sub-techniques.
   Name	The behavior name.
   ID	ID number of the technique and the sub-techniques. For techniques and sub-techniques with active detections (indicated by a blue shield icon), the ID number is a hyperlink that directs you to the Detections page.

   The primary technique box displays a blue shield icon if there are active detections related to this technique or its sub-technique, and if you have the required permission to view the detections in the Detection page. Techniques with an empty shield icon indicate that the detections are resolved. You can still view the detections in the Detections page. Techniques without any past or present detections are displayed as text. However, it may also indicate that you do not have permission to view the detections related to the technique.

   

5. To view the sub-technique, on the plus (+) symbol in the bottom-right corner of a Primary Technique box.

   

   The box expands to show the sub-techniques.

   

To download the coverage details:

• Click the Download Coverage Details button to download the coverage details as a CSV file which contains the Date Updated, Name, Primary Attack ID, Secondary Attack ID and Description.