Get MITRE ATT&CK Dashboard

Retrieves MITRE ATT&CK dashboard data based on the specified period and filter conditions.

Required Permissions

Requires the MEMBER role or higher.

HTTP Request

cURL Example

curl -H "Authorization: Bearer <API_KEY>" \
     "https://HOSTNAME/api/sonar/mitre-attack/dashboard?from=2024-01-01+00:00:00%2B0900&to=2024-01-31+23:59:59%2B0900"

Request Parameters

Success Response

{
  "dashboard": {
    "tactics": [
      {
        "mitre_id": "TA0001",
        "name": "Initial Access",
        "url": "https://attack.mitre.org/tactics/TA0001",
        "order": 1,
        "host_count": 5,
        "event_count": 42,
        "techniques_count": 2,
        "techniques": [
          {
            "mitre_id": "T1190",
            "name": "Exploit Public-Facing Application",
            "display_name": "Exploit Public-Facing Application",
            "url": "https://attack.mitre.org/techniques/T1190",
            "host_count": 3,
            "event_count": 18,
            "last_seen": "2024-01-31 12:30:00+0900",
            "blink": true
          }
        ]
      }
    ]
  }
}

• dashboard (Map): Dashboard data
  • tactics (Array): List of detection status by tactic. Sorted in ascending order of tactic order (order).
    • mitre_id (String): MITRE ATT&CK tactic ID
    • name (String): Tactic name
    • url (String): MITRE ATT&CK official documentation URL
    • order (32-bit integer): Tactic sort order
    • host_count (32-bit integer): Number of detected hosts
    • event_count (32-bit integer): Number of detected events
    • techniques_count (32-bit integer): Number of techniques associated with the tactic
    • techniques (Array): List of detection status by technique within the tactic. Sorted in descending order of host count.
      • mitre_id (String): MITRE ATT&CK technique ID
      • name (String): Technique name
      • display_name (String): Technique display name. If a parent technique exists, in the format "parent technique name: name".
      • url (String): MITRE ATT&CK official documentation URL
      • host_count (32-bit integer): Number of detected hosts
      • event_count (32-bit integer): Number of detected events
      • last_seen (String): Time of last detection. null if there is no detection history.
      • blink (Boolean): Whether to highlight due to a recent detection

Error Responses

Invalid date format

HTTP status code 400

{
  "error_code": "invalid-argument",
  "error_msg": "'from' parameter should be date format (yyyy-MM-dd HH:mm:ss+0000)"
}

Invalid IP address in addrs

HTTP status code 400

{
  "error_code": "invalid-argument",
  "error_msg": "invalid IP address: 999.999.999.999"
}

Invalid CIDR notation in addrs

HTTP status code 400

{
  "error_code": "invalid-argument",
  "error_msg": "invalid IP address in CIDR notation: 999.999.999.999/24"
}

CIDR mask out of 0~32 range in addrs

HTTP status code 400

{
  "error_code": "invalid-argument",
  "error_msg": "CIDR mask must be between 0 and 32: 10.0.0.0/33"
}