MITRE ATT&CK® Coverage Map

The MITRE ATT&CK® Coverage Map page provides a comprehensive visualization of how the Cisco Breach Protection Suite protects your organization against the tactics and techniques represented by the MITRE ATT&CK® Matrix for Enterprise. The product coverage mapping data is provided by Cisco Talos and it is associated with the detection content for the following Cisco products that are included in the Cisco Breach Protection Suite:

  • XDR Native (Network, Cloud, Identity, and Endpoint)

  • Secure Email Threat Defense

  • Secure Endpoint

  • Secure Malware Analytics

  • Secure Network Analytics

The Cisco products listed are included in the Cisco Breach Protection Suite.

Note: Having visibility into a technique does not ensure detection or protection against all occurrences of the technique and the coverages shown in the map does not reflect your specific product configurations or settings.

Choose Control Center > MITRE Coverage Map in the left navigation menu to open the MITRE ATT&CK® Coverage Map page and view the tactics and techniques that are covered by the Cisco Breach Protection Suite products. By default, the coverage map displays the tactics and techniques for the Cisco products that are integrated with Cisco XDR in your organization. You can filter the coverage map to display products that are not integrated for a comprehensive view of the coverage your organization would have if you integrate more Cisco products.

The tactics are listed in the top row and all the associated technique cards are listed alphabetically under each tactic. For more information on tactics and techniques, see MITRE ATT&CK Matrix for Enterprise. The number of techniques covered by the selected products are indicated under the tactic and each technique card underneath displays the total number of supported products selected for the technique, the number of incidents that are impacted by the technique, and the color-coded risk score for the technique. Hover over the product tag to display a detailed list of selected products covered by the technique and you can hover over the risk score to display the severity of the risk. For more information on the risk scores, see Color and Icon Key. Click a tactic or technique card to open the tactic or technique drawer for a high-level summary of the tactic or technique in one place, including a list of products covered and a list of XDR Native sources that provide coverage for the tactic or technique, if applicable.

The status of the integration is displayed below each product check box (Integrated or Not Integrated). If a product is not integrated in Cisco XDR, you can configure the integration on the Integrations page. For more information on adding an integration, see Integrations.

XDR Native represents the Cisco XDR native telemetry that is sent from the following sources: Network, Cloud, Identity, and Endpoint. You can integrate network, cloud, and identity sources in Cisco Secure Cloud Analytics. For more information, see Cisco Secure Cloud Analytics. The Network Visibility Module data is sent to Cisco XDR from the Endpoint source if you install the default deployment on your endpoints. For more information on installing the default deployment and viewing endpoints data, see Default Deployments.

Note: The coverages that are indicated on the coverage map do not reflect the Secure Cloud Analytics and Network Visibility Module configurations in your environment. Ensure that you verify your configurations in Secure Cloud Analytics and Client Management.

Secure Endpoint Configuration Insights is a display drawer that tells users what their organization's detection coverage is and what the current policy configuration for certain Secure Endpoint engines is. The Configuration Insights drawer lists the MITRE ATT&CK® tactics, techniques, and sub-techniques that can be detected and/or blocked by each of the Secure Endpoint engines. It also includes the percentage of endpoints with those engines enabled, set in audit mode, or disabled, as well as the related policies. These listings provide a means for users to verify if their current configuration of Secure Endpoint is maximizing its protection capabilities.

Secure Endpoint Configuration Insights is accessed from the MITRE ATT&CK® Coverage Map page. The Configuration Insights link is located underneath the Secure Endpoint integration check box.

You may also view Secure Endpoint configuration insights from a technique card in the coverage map. Any Secure Endpoint engines that have detections for the specified technique or sub-techniques and the technique's configuration mode is listed in a Secure Endpoint Policy Coverage section.

Click the Configuration Insights link to display the Secure Endpoint Configuration Insights drawer.

Note: If Secure Endpoint has not been integrated with Cisco XDR, you can still open the Configuration Insights drawer. In this instance, the drawer will indicate that Secure Endpoint has not been integrated and the Secure Endpoint Engine MITRE Display sections will be blurred.

The Secure Endpoint Configuration Insights drawer consists of two components.

Select Secure Endpoint Integration

This drop-down list allows you to choose the Secure Endpoint integration you want to review for MITRE ATT&CK® compliance and governance. Refer to the Integration Switcher of the Secure Endpoint documentation for more information on multiple Secure Endpoint integrations.

Click the Secure Endpoint Integration drop-down list and choose the integration in which you have a valid user account.
Secure Endpoint Engine Display Sections

The MITRE Coverage Map currently includes MITRE ATT&CK tactics, techniques and sub-techniques for the following four Secure Endpoint capabilities:

Note: The Secure Endpoint Configuration Insights drawer is meant to give users an overall sense of MITRE coverage. It only takes into account the conviction mode of the above capabilities and not exclusions, block/allow lists, custom detections, or other settings.

Each section consists of three areas.
  Engine/Feature Name

The name of the Secure Endpoint capability associated with the displayed results.
  MITRE ATT&CK®

The number of techniques and sub-techniques that can be detected by this capability.

This component shows the total number of techniques and sub-techniques that can be detected by this capability/feature, for the selected Secure Endpoint integration.

Click this link to display the Covered Techniques & Sub-techniques drawer, discussed in the Covered Techniques & Sub-techniques Drawer section below.
  Endpoint Mode Distribution

The total number and percentage of endpoints which have this capability in each of the different modes (i.e. Block, Protect, Enabled, Audit, and Disabled). A link to view the related policies is also included.
    Endpoint Percentage Bar

The top bar graph displays the percentage of the total number of endpoints that have block, protect, enabled, or audit mode turned on, or have all modes completely turned off.   Refer to the Modes and Engines section of the Windows Connector: Required Policy Settings topic in the Secure Endpoint documentation for more information on conviction modes.

Note: The block, protect, or enabled mode is the Cisco recommended mode.

This bar graph has three colors, representing the different conviction modes:

  • Purple represents block, protect, or enabled conviction mode.

  • Orange represents audit conviction mode.

  • Grey represents disabled conviction mode.

Note: Configuration Insights only includes endpoints running an operating system that is supported by that feature when calculating the percentage of endpoints in each mode.
    Endpoint Percentage Bar Legend

The percentage of the total number of endpoints for each conviction mode. Each listing consists of the color that represents the mode in the Endpoint Percentage Bar, the mode percentage and the name of the conviction mode.
    Total Endpoints Per Mode Display

The total number of endpoints that are set to the specified conviction mode. It also has a link to the related policies. Click View policies to display the Policy drawer, as discussed in the section Secure Endpoint Policy Drawer below.

Click the techniques and sub-techniques link in the Secure Endpoint Configuration Insights drawer opens the Covered Techniques & Sub-techniques Drawer.

This drawer displays all of the techniques and sub-techniques can be detected by that Secure Endpoint capability/feature. This drawer is composed of three areas, the drawer header, the technique and sub-technique search field, and the technique and sub-technique listings.

Covered Techniques & Sub-techniques Drawer Header

The drawer header lists the total number of techniques and sub-techniques that can be detected by Secure Endpoint's capabilities. It also lists the name of the specific Secure Endpoint capability.
Search Field

The drawer’s search field is used to locate one or more techniques or sub-techniques. This field will accept the technique or sub-technique's ID or the technique or sub-technique's name. It will also accept partial names or numbers.

Click the (Clear) icon to clear the field.

Technique and Sub-technique Listings

All of the techniques and the associated sub-techniques that can be detected by the listed Secure Endpoint capability.

All of the technique IDs can be clicked to display the MITRE ATT&CK® Coverage Map drawer that explains that technique. For more information on the technique details, refer to the View Technique Details in Drawer section of this topic.

Click View policies in the Total Endpoints Per Mode area to display the policy drawer.

This drawer lists all of the Secure Endpoint policies that have this engine/feature in that conviction mode. Click the policy name link to open the Secure Endpoint Policies page in a new tab with details of the policy loaded. The number of endpoints affected by the policy is displayed next to the policy name.

This drawer is composed of two main elements, the conviction mode name and the policies list.

Conviction Mode Name

Displays the name of the conviction mode in use for these policies. The arrow located to the left of the mode name will take you back to the Secure Endpoint Configuration Insights drawer.

Note: A link to the Secure Endpoint Best Practices Guide is located in the policy drawer description.
Policies List

Lists all of the Secure Endpoint policies that have this feature set to this conviction mode.

The policy list will display the policy name and the number of endpoints in that policy. Click the policy name to view the policy details of that specific policy in the Secure Endpoint portal.

Note: You must have access to Secure Endpoint and permissions to view the specific policy in order to view the policy details in Secure Endpoint.

Refer to the Secure Endpoint Policies topic of the Secure Endpoint documentation for more information.

When you click a tactic, the tactic drawer opens where you can quickly view more information on the selected tactic, including product coverages and a list of incidents that are impacted by the selected tactic.

The tactic drawer displays the following information about the tactic:

Tactic name and ID

The MITRE ATT&CK® tactic ID is displayed below the tactic name. For details on the tactic IDs, see Enterprise Tactics.

Risk Score

The risk score for the tactic indicates the probability of financial impact if the MITRE ATT&CK pattern is not mitigated--the higher the score, the higher the probability of impact. The risk score is the detection risk used to calculate the priority score for incidents and it is an internal calculation by Cisco's data science team based on the analysis of over 100,000 incidents costing customers upwards of 1 billion dollars.

The risk score is color-coded based on the score and you can hover over the risk score to view the severity of the risk. For more information, see Color and Icon Key.

Product Coverage

The products that are checked in the coverage map and covered by the current tactic are listed in the Selected coverage area. The Additional Cisco coverage area displays products that are unchecked in the coverage map but they are covered by the current tactic.

All the products in the Product coverage area are listed with the status of the integration in Cisco XDR and product links to learn more about the products. The sources listed next to XDR Native indicate the Cisco XDR sources that are covered by the current tactic.

Secure Endpoint Policy Coverage

Expand the panel to view the applicable Secure Endpoint Configuration Insights information. Refer to the Secure Endpoint Configuration Insights section above for more information.

Description

Expand the panel to view the description of the tactic. The description is provided by MITRE ATT&CK®. For a list of all the tactic descriptions, see Enterprise Tactics.

Incidents

Expand the panel to view the five most recent incidents that are impacted by the current tactic, with the creation date and the status of the incident listed for each incident. The total number of incidents for the tactic is also displayed. Click the incident link to open the incident detail in a new tab or click View all to open the Incidents page with a filtered list of incidents that are impacted by the current tactic in a new tab.

View on the MITRE ATT&CK® website

Click the link to open the MITRE ATT&CK® website in a new tab for more information on the current tactic.

To close the drawer, click the (Close) icon in the upper right corner.

When you click a technique card, the technique drawer opens where you can quickly view more information on the selected technique, including product coverages and a list of incidents that are impacted by the selected technique.

The technique drawer displays the following information about the technique:

Technique name, ID, and tactics

The MITRE ATT&CK® technique ID and related tactics are displayed below the technique name. For details on the technique codes, see Enterprise Techniques.

Risk Score

The risk score for the technique indicates the probability of financial impact if the MITRE ATT&CK pattern is not mitigated--the higher the score, the higher the probability of impact. The risk score is the detection risk used to calculate the priority score for incidents and it is an internal calculation by Cisco's data science team based on the analysis of over 100,000 incidents costing customers upwards of 1 billion dollars.

The risk score is color-coded based on the score and you can hover over the risk score to view the severity of the risk. For more information, see Color and Icon Key.

Product Coverage

The products that are checked in the coverage map and covered by the current technique are listed in the Selected coverage area. The Additional Cisco coverage area displays products that are unchecked in the coverage map but they are covered by the current technique.

All the products in the Product Coverage area are listed with the status of the integration in Cisco XDR and product links to learn more about the products. The sources listed next to XDR Native indicate the Cisco XDR sources that are covered by the current technique.

Adversaries

Expand the panel to view a list of adversaries that use the current technique. The adversaries that are checked in the Adversary Filters drawer and use the current technique are listed in the Filtered Adversaries area. The Additional Adversaries area displays adversaries that are unchecked in the Adversary Filters drawer but they use the current technique.

The number of selected adversaries for the current technique out of the total number of filtered adversaries is displayed next to Filtered Adversaries. The total number of additional adversaries that are not selected is displayed next to Additional Adversaries.

Secure Endpoint Policy Coverage

Expand the panel to view the Secure Endpoint Configuration Insights information. Refer to the Secure Endpoint Configuration Insights section above for more information.

Description

Expand the panel to view the description of the technique. The description is provided by MITRE ATT&CK®. For a list of all the technique descriptions, see Enterprise Techniques.

Sub-techniques

Expand the panel to view a list of the sub-technique IDs and names for the current technique. The total number of sub-techniques supported by the technique is displayed next to the title.

Incidents

Expand the panel to view the five most recent incidents that are impacted by the current technique, with the creation date and the status of the incident listed for each incident. The total number of incidents for the technique is also displayed. Click the incident link to open the incident detail in a new tab or click View all to open the Incidents page with a filtered list of incidents that are impacted by the current technique in a new tab.

View on the MITRE ATT&CK® website

Click the link to open the MITRE ATT&CK® website in a new tab for more information on the current technique.

To close the drawer, click the (Close) icon in the upper right corner.

You can filter the MITRE ATT&CK coverage map by product, risk score, and incident creation date, and adversaries to narrow the techniques displayed on the coverage map.

In the Product Coverages area, check the check boxes next to the integrations to filter the tactics and techniques covered by the selected integrations that are displayed on the page.

By default, the check boxes for the integrated products and all the XDR Native sources are checked. Check the check boxes next to the products that are not integrated to view the possible tactics and techniques that can be covered if you integrate more Cisco products. For more information on integrating products, see Integrations.

All the sources under the XDR Native check box are automatically checked by default, displaying the coverage information for all the sources that send telemetry data to Cisco XDR. To filter the sources, click the Select sources drop-down list and check or uncheck the check boxes next to the sources you want to include or exclude on the page.

The risk scores, including the color-coded severity of the risk scores, are displayed on the technique cards in the coverage map. You can filter the techniques based on the severity level of the risk score displayed on the technique cards (Critical, High, Medium, Low, Unknown, or All risk scores). For details on the severity, see Color and Icon Key.

Click the Minimum risk score drop-down list and choose the minimum severity of the risk score you want displayed in the coverage map. Only techniques with a risk score greater or equal to the selected severity will be shown. All risk scores is selected by default.

The number of incidents promoted and impacted by the tactics and techniques during the specified date range are displayed on the technique cards. By default, the number of incidents promoted and impacted within the last year is displayed. You can narrow the number of incidents based on the specific time frame using the incident created date drop-down list in the upper right corner of the Product Coverages area.

Click the Incident created date drop-down list and choose the date range for the number of incidents you want displayed on the technique cards and the list of incidents displayed in the tactic or technique drawer. For example, choose Last 30 days if you want to display the number of incidents that were promoted and impacted by the tactics and techniques in the last 30 days.

To display a detailed list of incidents for a specific tactic or technique, click the tactic or technique card and the incidents are listed in the technique drawer.

The Adversary Filters area allows you to filter the techniques in the coverage map by the MITRE ATT&CK adversaries and threat groups. Adversaries are known threat actors that are tracked by MITRE ATT&CK. For more information, see MITRE ATT&CK Groups. Filtering by adversaries allows you to view the techniques used by the adversary groups and whether the selected products protect you against the techniques used by the adversary groups.

Click Select adversaries to open the Adversary Filters drawer for a list of the adversary names, IDs, associated groups, industries targeted by the adversary, and countries targeted by the adversary. Check the check boxes next to the adversaries to filter the coverage map to display the techniques that are used by the selected adversary groups. The total number of adversaries available and the number of adversaries selected are displayed next to the Country drop-down list.

Search Adversaries

Use the Search text box in the upper portion of the drawer to narrow the display of adversaries. Enter the search criteria in the Search text box to search for adversaries by name, threat group ID, or associated groups. The adversaries that match your search criteria are displayed in the list below.

Filter Adversaries by Industry

You can filter the list of adversaries by industries that are targeted by the adversary groups. The industry data is extracted from the description of the adversary from MITRE ATT&CK.

In the Adversary Filters drawer, click the Industry drop-down list and check the check boxes next to the industry to filter the adversaries that are displayed in the drawer. The number of techniques that target the industry is listed next to each industry. Check the Unknown check box if you want to filter the list of adversaries by industries that have not been identified.

Filter Adversaries by Country

You can filter the list of adversaries by countries that are targeted by the adversary groups. The country data is extracted from the description of the adversary from MITRE ATT&CK.

In the Adversary Filters drawer, click the Country drop-down list and check the check boxes next to the country to filter the adversaries that are displayed in the drawer. The country code and the number of techniques that target the country is listed next each country. Check the Unknown check box if you want to filter the list of adversaries by countries that have not been identified.

Adversary Heatmap

After you select the adversaries, the Adversary heatmap radio button is selected by default and the color of the technique cards in the coverage map is updated to red, indicating the number of adversaries that uses each technique. For more information on the different shades of red, click the (Information) icon next to the Adversary Heatmap radio button to display a legend.

Click the Product coverage radio button to apply a purple color to the technique cards, indicating that the products selected in the Product Coverages area protect you against the techniques used by the selected adversaries.

The coverage chart in the upper right corner displays the techniques and tactics covered by the selected products and adversaries in two views: Techniques and Tactics. By default, the Techniques chart is displayed and the Tactics chart is displayed automatically when you apply the adversary filters.

The Techniques tab displays a donut chart that illustrates the percentage of techniques covered by the products checked in the Product Coverages area. Hover over the percentage to display the number of techniques covered out of the total number of techniques available. The number of techniques do not include duplicate techniques displayed under the row of tactics in the coverage map.

The chart is updated as you check and uncheck the product check boxes in the Product Coverages area.

The Tactics tab displays a radar chart that illustrates all the tactics with an overlay of the following:

  • Percentage of tactics covered by the products checked in the Product Coverages area

  • Percentage of tactics used by the adversaries selected in the Adversary Filters area

The points on each spoke of the radar chart represent the percentage of the total number of techniques used by adversaries or covered by the products. Hover over a tactic ID to display the tactic name, number of techniques covered by the selected products, and the number of selected adversaries used by the tactic. The number of adversaries selected are displayed next to Adversaries in the legend. The overlay of the selected product coverage and the selected adversaries in the radar chart indicates whether the products selected cover the tactics that are used by the adversaries. Click Expand in the upper right corner to open the radar chart in a popup and display a larger view of the radar chart.

The radar chart is updated as you check and uncheck the product check boxes in the Product Coverages area or check and uncheck the adversaries in the Adversary Filters drawer.