MITRE ATT&CK | Analysis | Customize#

You can customize the heat maps that have been created.

Permissions#

To be able to create and customize heat maps , your user must have a role with these permissions:

  • read attack

  • modify attack

Change scope#

Add intelligence#

  1. In the Scope field, select Entities.

  2. Create a query and select the individual entities you want to include in the heat map by checking their boxes.

  3. When you’ve selected all the individual entities you want to include, select Select.

Remove intelligence#

To remove the added dataset or remove all entities at once, in the Scope field, select the relevant X delete button.

To remove specific entities:

  1. In the Scope field, select Entities.

  2. Create a query and select the individual entities you want to delete from the heat map by checking their boxes.

  3. When you’ve selected all the individual entities you want to remove, select Select.

Use filters#

The Filter Filter on the left side allows you to exclude entities from the heat map without removing them. This follows the general behavior of filters in Intelligence Center.

When you filter out an entity it decreases the score of tactics and (sub-)techniques assigned to it. If the heat map is set to hide cards not assigned to any entities, filtering out the last entity a card is assigned to means the card will be hidden.

Changing the scoring for classifications#

To switch the scoring method for all the classifications in the heat map:

  1. In the top-right corner, select the More More actions button.

  2. From Calculate aggregate scores, select the Calculate aggregate scores toggle to switch aggregate scoring on or off.

  3. When Calculate aggregate scores is on, toggle Count classifications that scored zero on to switch aggregation method.

Changing the overview#

Hide cards not assigned to any entities#

Select the Show cards with associated entities button to only show the cards of classifications that are assigned to at least one entity.

Hide cards without annotations#

Select the Show cards with annotations button to only show the cards with annotations added to them.

Show/Hide sub-techniques#

Select the Show sub-techniques button to show sub-technique as well as tactic and technique cards. When showing, select the Hide sub-techniques button to hide them again.

When showing, you can select the Expand techniques/Collapse techniques to expand or collapse all techniques at once.

Change the color palette#

  1. In the top-right corner, select the More More actions button.

  2. From Color Palette, select a different color palette.

Show or hide the number of entities classifications are assigned to#

  1. In the top-right corner, select the More More actions button.

  2. Select Show details in cards to toggle it on or off.

You’ll see the number of entities classifications are assigned to appear on or disappear from the cards.

Show or hide the IDs of the classifications#

  1. In the top-right corner, select the More More actions button.

  2. Select Show details in cards to toggle it on or off.

You’ll see the MITRE IDs of classifications appear on or disappear from the cards.

Sort the heat map#

Selecting the Sort by button shows a dropdown allowing you to sort:

  • A to Z

  • Z to Z

  • by score

When sorting by score, (sub-)techniques with the same score will be sorted either A-Z or Z-A depending on your selection.