Logpoint and MITRE ATT&CK framework

Automatically add context. Transform weak alerts into meaningful investigations, providing analysts orchestration and automation actions at their fingertips to respond faster than ever.

MITRE is a non-profit organization focused on cybersecurity and solving security challenges to create a safer IT environment for organizations. MITRE developed the ATT&CK framework to classify adversarial tactics universally. ATT&CK is also a database that organizations can use to reference and document threat behaviors across the entire attack lifecycle.

Go To ATT&CK Navigator

MITRE ATT&CK tactics and techniques

The ATT&CK model assigns a unique ID to every adversarial tactic used within the typical process of an intrusion. The tactics help verify the existence of an intrusion, the type of intrusion and a prediction of what will happen next. Security teams can use the tactics when monitoring and responding to incidents.

The tactics are not concrete technologies or actions, but instead, they are conceptual, which means ATT&CK can be used to classify new techniques. Security teams can use ATT&CK for threat intelligence and reporting for a faster, more flexible and more informed approach to cybersecurity.

DOWNLOAD MITRE WHITEPAPER

Situational awareness of your entire infrastructure

All the security functionality in Logpoint SIEM is based on the MITRE ATT&CK framework. Logpoint has developed all queries, as well as future technological enhancements, around the common ATT&CK taxonomy. Alerts in Logpoint are configured to the different stages of the ATT&CK model, making it easier to get situational awareness of the entire system. The advanced threat detection in Logpoint SIEM means that security teams can analyze and report trends and behaviors of entities and users within the organization.

Faster detection

Alerts are based on a standard framework, making it easier for analysts to detect malicious activity

Faster response

The ATT&CK steps are sequential, so analysts can predict an adversary’s actions and be one step ahead in the investigation

Comprehensive risk assessment

It’s much easier to map security coverage and risks when your defenses are all based on the same taxonomy

Understand the adversary

Security teams can create a more effective defense to protect their system. ATT&CK helps teams understand the adversary and how they operate

Minimize skills gap

The ATT&CK framework gives junior security analysts without much experience a knowledge base to figure out how to investigate and respond to incidents

Cohesive defense strategy

You can integrate ATT&CK with other security tools and services to standardize your entire infrastructure for a more effective cybersecurity defense

A blueprint for attack techniques

The Logpoint ATT&CK navigator has more information about the tactics and techniques and indicates which are covered by Logpoint SIEM and Logpoint UEBA. Techniques represent how an adversary achieves an objective. Security analysts can use the navigator to match Logpoint alerts with their relevance to ATT&CK, from initial access to privilege escalation to lateral movements to data exfiltration.

Go To The ATT&CK Navigator mitre-attck