MITRE ATT&CK

Overview

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is an industry-standard framework that systematically classifies adversary tactics and techniques observed in real-world cyberattacks. Tactics represent adversary objectives (e.g., initial access, execution, persistence, privilege escalation), and techniques represent the specific methods used to achieve those objectives.

In the Sonar web console, navigate to Analysis > MITRE ATT&CK to view detected events in a MITRE ATT&CK matrix format. The matrix arranges tactics as columns and displays techniques belonging to each tactic as cards. Each technique card shows the number of hosts where events related to that technique were detected, and the card color indicates the severity level based on the host count. Click a technique card to view its details.

Events displayed in the matrix originate from stream rule and batch rule scenarios. You can map MITRE ATT&CK tactics and techniques to each detection scenario. When a scenario detects an event, the tactic and technique information is automatically tagged to that event. The matrix aggregates these tagged events and visualizes detection status by tactic and technique.

This menu is available to accounts with user-level access or higher.

How hosts are counted

The host count shown in the matrix and in the technique details is the number of internal hosts in the detection events. Internal hosts are determined by 내부망 대역 (internal network ranges), the built-in group in Subnet groups. The product installs this group with its Korean name in every console language.

• For each detection event, host_ip, src_ip, and dst_ip are checked in that order, and the first address inside 내부망 대역 is counted as the host of the event. For example, an event with no host_ip whose source and destination are both internal counts only the source IP.
• Events whose three addresses are all outside 내부망 대역 are not counted anywhere in the matrix or the technique details. By default the group contains the three private IP ranges (10.0.0.0-10.255.255.255, 172.16.0.0-172.31.255.255, and 192.168.0.0-192.168.255.255), so if the assets you protect are outside them, add their ranges to 내부망 대역 as subnets. This page does not refer to subnet groups you create separately.
• The hostname of an endpoint comes from Assets. Registering an asset only identifies the host; it does not decide what is counted.

Viewing the matrix

Navigate to Analysis > MITRE ATT&CK to view the MITRE ATT&CK matrix. The matrix refreshes automatically every 60 seconds.

Toolbar

The toolbar at the top of the matrix provides controls for setting query conditions.

• Date Range: Select the event date range. The default is 1 day (24 hours). You can choose from 1 hour, 1 day, 7 days, or 30 days. Based on the selected range, events from the current time back to the specified period are displayed. The actual time range applied is shown to the right of the selector.
• Search type: Select the keyword type for the filter: IP/CIDR or Hostname. The default is IP/CIDR.
• Search field: Enter keywords matching the search type and press Enter to add a filter. You can enter multiple keywords separated by spaces. If the keyword format is invalid, an error message is displayed.

The following buttons are available on the right side of the toolbar:

• Fit to screen: Displayed only in full-screen mode. Automatically adjusts the matrix column width to fit the screen width. Click again to restore the original width.
• Hide/Show: Toggles the visibility of technique cards with no events. When enabled, technique cards with zero hosts are hidden, showing only detected techniques.
• Full screen: Switches the matrix to full-screen mode. Click again to restore the original size.
• Refresh: Refreshes the matrix with the latest data.

Filters

The filter area below the toolbar lists the filters added from the search box as tags. You can combine IP addresses and hostnames for filtering.

• To remove a specific filter, click the filter tag.
• To remove all filters at once, click the Delete all button.

When filters are applied, only events related to the specified IP addresses or hostnames are reflected in the matrix.

• An IP/CIDR filter keeps events in which any of host_ip, src_ip, or dst_ip equals the IP address or falls inside the range you entered. Even when you filter by an external IP, the host count still counts the internal hosts of those events.
• A Hostname filter narrows events by the IP addresses of assets registered with that hostname in Assets. The hostname must match exactly, and a hostname that is not in Assets leaves the matrix with no counts.

Tactic cards

At the top of each column in the matrix, a tactic card is displayed. The tactic card shows the tactic name and the number of hosts where events belonging to that tactic were detected.

Technique cards

Below each tactic card, technique cards belonging to that tactic are listed. Each technique card shows the technique name and the number of hosts where events were detected.

The background color of technique cards indicates the severity level based on the number of detected hosts:

If the host count is 0, no background color is applied. When a new event is detected, the corresponding technique card blinks to indicate the change.

Technique details

Click a technique card in the matrix to open a detail panel on the right side of the screen.

The top of the detail panel shows the technique's MITRE ID and name. The panel provides the following information:

• Date Range: Displays the date range set in the matrix.
• Occurrence Statistics: Shows the number of detected hosts and event count related to the technique.
• Occurrence Trend: Displays the event trend within the date range as a bar chart. The X-axis represents time and the Y-axis represents event count. The bar with the highest event count is highlighted in red. The chart time unit adjusts automatically based on the date range (1 day or less: 1 hour, 7 days or less: 1 day, 30 days or less: 1 day, over 30 days: 1 week).
• Endpoints: Shows a table of endpoints where events related to the technique were detected. Up to 15 entries are displayed.
• Description: The technique description provided by MITRE ATT&CK. By default, up to 3 lines are shown. Click Show More to view the full content, and click Collapse to minimize it again.
• Tactic: Lists the tactics to which the technique belongs. A single technique can belong to multiple tactics. Click a tactic name to open the corresponding tactic page on the official MITRE ATT&CK site in a new window.
• Sub Techniques: Lists the sub-techniques of the technique. Displayed only when sub-techniques exist. Click a sub-technique name to open the corresponding sub-technique page on the official MITRE ATT&CK site in a new window.
• URL: A link to view detailed information about the technique on the official MITRE ATT&CK site.

To close the detail panel, click the button at the top-left of the panel or press Esc.

Endpoint table

The endpoint table provides the following information:

If there are 15 or more endpoints, a Show All button appears at the bottom of the table. Click this button to run a query that retrieves the full endpoint list in a new window.

IP address action menu

Click an IP address in the endpoint table to display an action menu for that IP.

• View Asset: Navigates to the Assets detail page for the IP. Displayed only when asset information is registered.
• Search Ticket: Opens a new window to search for tickets related to the IP.
• Search Event: Runs a query in a new window to retrieve events related to the IP.
• Search Log: Runs a query in a new window to retrieve raw logs related to the IP.