Why Use MITRE ATT&CK in Ardoq?
Using MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) in Ardoq enables organizations to map their security controls and detection capabilities against known adversary behaviors, identify coverage gaps, and prioritize security investments. It provides a common framework for threat intelligence, detection engineering, and security operations teams to communicate about threats and defenses.
How Ardoq Adopts MITRE ATT&CK v15.1
The MITRE ATT&CK framework is implemented as a single workspace containing the complete taxonomy of Tactics, Techniques, and Sub-techniques from the Enterprise ATT&CK Matrix.
Structure Element | Details |
Workspace Name | Mitre Att&ck Framework v15.1 |
Component Types | • Risk Category - The category component is used when multiple components need to be organized in a categorized hierarchy. This may be of arbitrary depth, with the leaf nodes being of the component type that is organized in the hierarchy. The component type name may optionally be made more specific with a prefix (e.g. Risk Category or Process Category). • Risk - A risk is a potential event that, should it occur, will cause a loss to the organization. They may be financial, strategic, operational or hazard, with potential impact across any part of an organization. Some types of risk have particular consequences for IT systems, technologies and networks. These include information security and cyber-risks and threats. |
Framework Structure
The workspace organizes MITRE ATT&CK into 14 tactical categories:
Collection - Techniques for gathering information from target systems
Command and Control - Methods adversaries use to communicate with compromised systems
Credential Access - Techniques for stealing account credentials
Defense Evasion - Methods to avoid detection during an operation
Discovery - Techniques for gaining knowledge about systems and networks
Execution - Techniques for running adversary-controlled code
Exfiltration - Methods for stealing data from the network
Impact - Techniques for disrupting availability or compromising integrity
Initial Access - Techniques used to gain entry into a network
Lateral Movement - Techniques for moving through the environment
Persistence - Techniques for maintaining access to systems
Privilege Escalation - Techniques for gaining higher-level permissions
Reconnaissance - Techniques for gathering information before an attack
Resource Development - Techniques for establishing resources to support operations
Importing MITRE ATT&CK into Ardoq
Access the MITRE ATT&CK framework through Ardoq's Frameworks & Resources Importer. For step-by-step instructions, see How to use the Frameworks & Resources Importer.