Mapping MITRE ATT&CK Techniques

When to Use

Use this skill when:

• Generating an ATT&CK coverage heatmap to show which techniques your detection stack addresses
• Tagging existing SIEM use cases or Sigma rules with ATT&CK technique IDs for structured reporting
• Aligning your security program roadmap to specific adversary groups known to target your sector

Do not use this skill for real-time incident triage — ATT&CK mapping is an analytical activity best performed post-detection or during threat hunting planning.

Prerequisites

• Access to MITRE ATT&CK knowledge base (https://attack.mitre.org) or local ATT&CK STIX data bundle
• ATT&CK Navigator web app or local installation (https://mitre-attack.github.io/attack-navigator/)
• Inventory of existing detection rules (Sigma, Splunk, Sentinel KQL) to assess current coverage
• ATT&CK Python library: pip install mitreattack-python

Workflow