The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Use the MITRE ATT&CK framework to understand alert activity and impact

Prev Next

It can be difficult to understand all of the activity in an alert, and how this could impact your environment. The MITRE ATT&CK framework maps cybersecurity data to tactics and techniques used by attackers. If this information is available, you can view it on the MITRE tab. The MITRE tab shows the whole MITRE ATT&CK matrix. Each column corresponds to a different tactic with many techniques. If a tactic and an associated technique are used in the alert, the column header and technique are highlighted.

You can view techniques for all IOCs, or you can select one from the menu. Each description can be expanded to see more information. To view detailed information about each technique, right-click and select Go to MITRE ATT&CK.