Manage Tools
Manage the tools information that you imported from the MITRE TAXII collections. Tools are legitimate software that are used by threat actors to perform attacks.
Before you begin
Role required: sn_sec_tisc.analyst
About this task
Tools enable you to know how and when threat actors use them for executing campaigns. Unlike malware, these tools or software packages are often found on a system and have legitimate purposes for power users, administrators, network administrators, or even normal users.
Procedure
To view the MITRE ATT&CK Repository data, navigate to Workspaces > Threat Intelligence Security Center > Threat Intel Library > MITRE ATT&CK > Tools.
You can view the listed tools.
Click a tool to view all the associated information.
Click New to manually create the MITRE ATT&CK tools.
Fill in the fields appropriately.
Field Description ID Unique ID for a course of action to prevent an attack. Revoked Indicates that the revoked objects are no longer considered valid by the object creator. Name Enter a descriptive name to identify the object. Source Specifies the threat source from which this object record is created. Aliases A list of other names to identify this object. Created Time In Source Specifies the time the object is created in the source. Modified Time In Source Specifies the time the object is modified in the source. Description A description that provides more details and context about the object, potentially including its purpose and its key characteristics. Contributors Specifies the contributors. Insights Notes Any additional information related to the mitigation. Additional Information Additional Context Add any additional context for this object. Comments Add any comments for this object. Click Save.
To view how these objects are related, click Relationships.
Parent Topic:MITRE-ATT&CK Repository