MITRE ATT&CK | Analysis | Create

You create a heat map by selecting entities for its scope. This can include entire datasets or workspaces, individual entities from a query, or a combination of all of these.

Create a new heat map

1. In the side navigation bar, go to ATT&CK Analysis.

2. Select to open a blank heat map.

3. From the Matrix dropdown in the top-left corner, select the matrix that applies to the heat map you are creating. By default, heat maps are created with the Enterprise matrix.

4. In the Scope field, select the icon.

5. From the dropdown, select Entities or Datasets.

   • To add entities, create a query and select the individual entities you want to include in the heat map by checking their boxes. When you’ve selected all the individual entities you want to include, select Add to selection. You can add up to 1000 entities.

   • Use the Search to query workspaces and datasets. To add a dataset, select want to add to the heat map by checking its box. You can only add one dataset.

The resulting heat map will show how often each tactic and (sub-)technique is assigned to the entities included in it.

Not saved automatically

When you open a new heat map, it isn’t automatically saved.

You can save it by selecting Save analysis after you’ve made changes and entering a name and a description.

You can also customize existing ATT&CK heat maps.