PSC: How to get more information on MITRE TTPs
search cancel

PSC: How to get more information on MITRE TTPs

book

Article ID: 289499

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Provide steps to view details on MITRE ATT&CK framework TTPs on the Alerts page

Environment

  • Predictive Security Cloud (PSC): February 18, 2020 Release (0.52.1 backend)
    • Cloud Endpoint Standard (fka CB Defense)
    • Cloud Enterprise EDR (fka CB ThreatHunter)
    • CB ThreatSight¬†

Resolution

  1. Go to Alerts page
  2. Click into Search bar
  3. Begin typing MITRE to view list of related TTPs
  4. Select desired MITRE TTP and press Enter to search
    Example
    TTP:MITRE_T1075_PASS_THE_HASH
  5. Expand items displayed to view full list of TTPs linked to selected AlertID
  6. Click on the pill/button with desired MITRE TTP listed
  7. New tab opens in browser with information on MITRE technique or tactic
    Example
    https://attack.mitre.org/techniques/T1075/

Additional Information

Repeat as desired for other MITRE TTPs or use the MITRE site (https://attack.mitre.org) to look for information on other Tactics, Techniques, and Procedures (TTPs)