Skip to main content

MITRE ATT&CK Integration

800+ threat techniques with automatic classification, filtering, and configuration management.

Industry Standard

MITRE ATT&CK is a globally recognized framework for understanding adversary tactics and techniques based on real-world observations.

Overview​

CastellanAI integrates the MITRE ATT&CK framework to provide standardized threat technique classification and mapping.

MetricCount
Techniques800+
Tactics14
Groups100+

Security events are automatically mapped to MITRE ATT&CK techniques, providing context for threat hunting, incident response, and security analytics.

ATT&CK Tactics​

The framework organizes adversary behavior into 14 tactical categories:

Initial Access Tactics​

TacticDescription
ReconnaissanceGathering information for planning attacks
Resource DevelopmentEstablishing resources for operations
Initial AccessGetting into the target network

Viewing MITRE Techniques​

Accessing the Database​

Navigate to Threat Intelligence in the top navigation bar or Settings → MITRE Techniques.

Statistics Dashboard​

StatisticDescription
Total TechniquesNumber of techniques in the database
Last UpdatedWhen the database was last refreshed
Cache StatusIndicates when data is cached for fast loading

Searching and Filtering​

FilterOptions
SearchSearch by technique ID, name, or description
TacticFilter by any of the 14 tactics
PlatformWindows, Linux, macOS, Network, Cloud, Mobile

Technique Details​

Technique Cards​

Each technique displays:

FieldDescription
Technique IDOfficial MITRE identifier (e.g., T1059.001)
NameHuman-readable technique name
TacticTactical category (color-coded)
DescriptionBrief overview
PlatformsTargeted platforms

Integration Features​

Automatic Classification​

Security events are automatically mapped using:

MethodDescription
Rule-based detectionWindows Event IDs mapped to techniques
AI analysisPattern matching for technique identification
Behavioral correlationMulti-event analysis for technique chains

Security Event Integration​

When viewing security events:

  • MITRE techniques appear as purple badges on each event
  • Click techniques to see detailed information
  • Filter events by specific techniques
Quick Navigation

Click any technique badge on a security event to jump directly to its full details.

Managing the MITRE Database​

Importing Techniques​

  1. Navigate to Settings → MITRE Techniques
  2. Click Import Techniques
  3. Wait for the import to complete (800+ techniques)
Import Time

Initial import may take several minutes depending on your connection.

Common Use Cases​

Threat Hunting Workflow​

Search for specific attack techniques to proactively identify threats:

  1. Go to Threat Intelligence
  2. Filter by tactic (e.g., "Credential Access")
  3. Review techniques like T1110 (Brute Force)
  4. Search Security Events for matching events

Common Techniques Monitored​

CastellanAI provides built-in detection for commonly observed techniques:

Technique IDNameTactic
T1059.001PowerShellExecution
T1078Valid AccountsInitial Access
T1110Brute ForceCredential Access
T1021.001Remote Desktop ProtocolLateral Movement
T1053.005Scheduled TaskPersistence
T1543.003Windows ServicePersistence
T1486Data Encrypted for ImpactImpact
T1562.001Disable Security ToolsDefense Evasion
T1003OS Credential DumpingCredential Access

Pagination​

The techniques database supports pagination:

  • 25 techniques per page
  • Navigate between pages using Previous/Next buttons
  • Shows current position (e.g., "Showing 1 to 25 of 823 techniques")

MITRE ATT&CK Resources​

🔗 Official Resources

What's Next?​

GuideDescription
Event MonitoringView security events with MITRE mappings
Threat DetectionHow threats are detected and classified
Malware ScanningFile-based threat detection