PSC: How to get more information on MITRE TTPs

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Provide steps to view details on MITRE ATT&CK framework TTPs on the Alerts page

Environment

• Predictive Security Cloud (PSC): February 18, 2020 Release (0.52.1 backend)
  • Cloud Endpoint Standard (fka CB Defense)
  • Cloud Enterprise EDR (fka CB ThreatHunter)
  • CB ThreatSight 

Resolution

1. Go to Alerts page
2. Click into Search bar
3. Begin typing MITRE to view list of related TTPs
4. Select desired MITRE TTP and press Enter to search

   Example
   TTP:MITRE_T1075_PASS_THE_HASH

5. Expand items displayed to view full list of TTPs linked to selected AlertID
6. Click on the pill/button with desired MITRE TTP listed
7. New tab opens in browser with information on MITRE technique or tactic

   Example
   https://attack.mitre.org/techniques/T1075/

Additional Information

Repeat as desired for other MITRE TTPs or use the MITRE site (https://attack.mitre.org) to look for information on other Tactics, Techniques, and Procedures (TTPs)