Using the MITRE ATT&CK analytics dashboard

This section describes common use cases for the MITRE ATT&CK dashboard.

Viewing your current and potential MITRE ATT&CK coverage

The MITRE ATT&CK dashboard provides a view of the current coverage for MITRE ATT&CK technique detection.

To see how additional Data Source telemetry will increase your MITRE ATT&CK coverage, select a Data Source from the ​ Select Additional Data Sources ​ dropdown menu.

Mapping Data Sources to overall Forescout Cloud Mitre attack coverage

Clicking the Data Source tab resets the view to a blank slate.

You can expand a MITRE Technique to show the sub-techniques upon which it is based, and clicking on a sub-technique will link you to the official MITRE ATT&CK web page with details. From this view, you can also select Data Sources from the Select Additional Data Sources dropdown to see the MITRE ATT&CK techniques that a particular Data Source telemetry enables.

Viewing the rule and Data Source components that comprise coverage for a particular MITRE ATT&CK technique

When you click on a MITRE ATT&CK technique displayed on the dashboard, such as "Boot or Logon Autostart Execution", the Rules screen opens in a separate window. It displays the Indicator rules and associated Data Sources that define the Detection rule.

Clicking on an Indicator rule displays information about the rule, including the Data Sources upon which the rule relies.