Understanding Threat Frameworks¶
A threat framework gives security teams a shared structure for describing harmful activity, organising evidence, planning defences, and communicating priorities.
What you will learn
This page explains what threat frameworks are, introduces MITRE ATT&CK as the primary framework used in this kit, and shows how to create evidence-based ATT&CK mappings.
What is a threat framework?¶
Threat frameworks organise complex security information so different teams can describe and compare it consistently. A framework may focus on different parts of the problem:
| Framework focus | Question it helps answer |
|---|---|
| Attacker behaviour | What goal is the attacker pursuing, and what method are they using? |
| Attack stages | Where is the activity within the wider path from initial access to impact? |
| Incident relationships | How are the attacker, victim, infrastructure, and capability connected? |
| Defensive coverage | Which important behaviours can the organisation see, detect, test, and respond to? |
A framework is a thinking and communication tool. It does not automatically identify the organisation's risks, prove that a detection works, or replace investigation evidence.
What is MITRE ATT&CK?¶
MITRE ATT&CK is a knowledge base that organises observed attacker behaviour. It gives security teams a shared way to describe what an attacker is trying to achieve and how they may do it.
ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge. It is the main threat framework used throughout this kit and the framework displayed by ATT&CK Navigator.
How ATT&CK is organised¶
Tactic¶
The attacker's immediate goal, such as gaining access to account credentials.
Technique¶
A general method used to reach that goal, such as capturing information entered by a user.
Sub-technique¶
A more specific form of a technique, such as recording keys pressed on a keyboard.
Procedure¶
How a particular attacker or tool carried out the technique using a specific command, file, or sequence.
Mitigation¶
A control that may reduce the chance or impact of the behaviour.
Data source¶
The type of information defenders can examine, such as program activity recorded by an endpoint tool.
ATT&CK includes separate collections, called domains, for enterprise technology, mobile devices, and industrial control systems. Select the domain that matches the environment being studied.
How defenders use ATT&CK¶
Describe incidents¶
Use shared technique names when recording attacker behaviour supported by evidence.
Plan detections¶
Identify which activity records and detection logic may reveal a technique.
Review coverage¶
Compare important attacker behaviours with existing visibility, detections, and test results.
Design exercises¶
Select relevant behaviours for authorised security validation and training.
A practical mapping workflow¶
- ObserveRecord what actually happened using the available evidence.Start with facts
- DescribeExplain the behaviour in plain language without choosing a technique yet.Avoid assumptions
- SearchFind ATT&CK techniques whose full descriptions may match the behaviour.Create candidates
- CompareReview definitions, sub-techniques, examples, and relationships.Check the detail
- SelectChoose the closest mapping supported by the evidence, not by keywords alone.Use the best fit
- DocumentRecord the evidence, reasoning, confidence, ATT&CK version, and uncertainty.Make it reviewable
- ReviewUpdate the mapping when new evidence or ATT&CK changes the interpretation.Keep it current
Try an ATT&CK mapping¶
Choose an observed behaviour, then add the information that makes the mapping reviewable.
Key takeaway
ATT&CK mapping should communicate evidence and reasoning. A technique name or coloured square alone does not show that the behaviour was observed or that a defence works.
ATT&CK is not a checklist
Colouring every technique does not prove that an organisation is secure. A technique can contain many different behaviours, and one detection rarely covers all of them. Coverage should describe the available data, detection logic, testing evidence, limitations, and confidence.
Common mistakes¶
- Mapping a product feature without evidence that it detects the technique
- Treating one alert as complete coverage
- Selecting techniques from keywords alone
- Mixing attacker goals with the methods used to reach them
- Ignoring sub-techniques that provide a more precise match
- Comparing layers created with different scoring rules
- Treating missing colour as proof that no defence exists
- Failing to record the ATT&CK version used
What ATT&CK does not provide¶
ATT&CK does not automatically:
- Rank the risks that matter most to an organisation
- Confirm that a detection works
- Measure security maturity
- Replace threat intelligence or incident evidence
- Specify the exact data, rule, and test needed for every environment
- Guarantee that a mapped control covers every form of a technique
Use ATT&CK as a common language and planning aid alongside risk assessment, testing, operational knowledge, and evidence.
ATT&CK Navigator platform profile¶
ATT&CK Navigator is a web-based tool for exploring ATT&CK matrices and creating coloured, scored, or annotated layers.
| Area | Evaluation starting point |
|---|---|
| Best suited to | Visualising selected ATT&CK techniques for planning, comparison, communication, or review |
| Common uses | Detection coverage, incident mapping, threat comparison, exercise planning, and prioritised improvement |
| Layer contents | Technique selections, colours, scores, comments, links, and supporting notes |
| Good practice | Define the purpose, ATT&CK version, scoring meaning, evidence standard, owner, and review date |
| Important boundary | Navigator displays the team's assessment; it does not test or verify the claimed coverage |