Manage matrices

Manage the matrices that have been imported from the MITRE TAXII collections. Matrices are a collection of tactics and techniques. You can view the matrices to review if your collections are available in the MITRE-ATT&CK repository.

Before you begin

Note: Review and verify that only the matrix you intend to use in your organization is set to active and disable the other matrices. For example, if you intend to use the Enterprise ATT&CK matrix, then the Enterprise ATT&CK matrix is activated at the TAXII collection level and in the Matrices level. Disable the other Mobile ATT&CK and ICS ATT&CK matrices at the TAXII collection and at the Matrices level.

Role required:

• sn_ti.admin: delete access
• sn_ti.read: read access
• sn_ti.write: create, write access

Procedure

1. Navigate to All > Threat Intelligence > MITRE ATT&CK Repository > Matrices.

   All matrices are disabled by default.

2. To activate a matrix, point to Active, double-click, and select true.

3. To view all the associated information, click a matrix.

4. To view all the tactics that are associated with this collection, click the MITRE Tactics tab.

5. To view additional details and the techniques that are associated with a selected tactic, click a tactic.

6. Under the MITRE ATT&CK Techniques tab, select a technique.

7. Under the related lists, view the associations that are available for the technique that you selected.

   In the following illustration, you can see the navigational path from the Enterprise ATT&CK matrix, to the Initial Access (TA0001) tactic, and then to the Phishing (T1566) technique. On the Attack Pattern - Phishing technique page, you can view the related list - Tactic, Sub Technique, Group, Mitigation, External References, Malware, and Tools.

What to do next

You can extend the information in some of these related list objects based on the technique that you selected. For example, you can add new information for Group, Mitigation, External References, Malware, and Tools.

Parent Topic:MITRE-ATT&CK administration

Related topics

Get started with MITRE-ATT&CK framework

Understand the MITRE to STIX data model

Domain separation and MITRE-ATT&CK

Set up the MITRE-ATT&CK framework

Manage techniques

Manage mitigations

Manage groups

Manage malware

Manage tools

Manage MITRE relationships

Manage CVE and technique mapping

Extend the MITRE-ATT&CK data

Define the data source and detection tool mapping

Define the data source and data component mapping

Define the technique detection coverage

Map your technique detection coverage to a technique

Define the mitigation coverage

Map your mitigation coverage to a technique

Create and map detection rules

Auto-extract technique rules for importing MITRE-ATT&CK information

Review threat group and MITRE-ATT&CK techniques mapping

Threat group to technique heatmap definition

Review the MITRE-ATT&CK system properties