Heatmap Analysis | Create#

You create a heat map by selecting entities for its scope. This can include a dataset, results from a search query, or individually selected entities.

Create a new heat map#

  1. From the left sidebar, go to Heatmap analysis.

  2. Select Create icon to open a blank heatmap.

  3. From the Framework drop-down menu in the top-left corner, select the framework that applies to the heatmap you are creating. By default, heatmaps are created with the MITRE ATT&CK Enterprise matrix.

  4. In the Scope field, select the Create icon icon.

  5. You can add entities to the heatmap scope in three ways:

    • Search query: Use the Search to add all entities from a search result to the scope.

    • Datasets: Add all entities inside a dataset to the scope. You can only add one dataset.

    • Entities: Individually select specific entities you want to include in the heatmap by checking their boxes. When you’ve selected all the individual entities you want to include, select Add to selection. You can add up to 1000 entities.

The resulting heatmap will show how often each tactic and (sub-)technique is assigned to the entities included in it.

Not saved automatically

When you open a new heat map, it isn’t automatically saved.

You can save it by selecting Save analysis after you’ve made changes and entering a name and a description.

You can also customize existing ATT&CK heat maps.