You can set filters based on your requirement in the MITRE ATTACK View page that provide you the capability to drill down into the attack details, learn more about the adversarial behavior, and nature of the cyber attack.
When you navigate to Analysis → <Admin Domain Name> → MITRE ATTACK View, it displays the matrix table and related data only for matching attacks for the time period set in the page. No filter criteria is set at this point of time. You can add one or more filters by performing the steps given below:
Steps:
On the Analysis tab, select the required domain from the Domain drop-down list in the left pane, and open the MITRE ATTACK View page.
Click
.png)
button.Add Filter Criterion dialog-box appears.
Add Filter Criterion dialog.png "GUID-930A6D2F-B1DD-4CAF-975F-DAAE0E2CB081-low.png")
Enter the values in the following fields:
Filter On — Select Attack Severity or IP Address from the drop-down list.
Value — Enter the specific value as per the filter chosen. For IP address selected as the filter, you can manually enter any IPv4 or IPv6 IP address that you want to examine including attacker IP and target IP. For Attack Severity selected as the filter, you can choose Informational, High, Medium or Low from the Value drop-down list.
Note
You can apply one or more IP addresses or attack severity levels as filters.
Click Save.
The page reloads and shows tactics, techniques, and sub-techniques in the Mitre matrix table format for the matching attacks based on the filter(s) applied. For example, the figure below shows the filtered data on the MITRE ATTACK View page after IP 11.1.1.18 and attack severity level High have been applied as filters.
The page view after applying IP and attack severity filters.png "GUID-0BED2D43-7F97-4A5F-9893-A35E3B5B6C81-low.png")