Skip to content

Enum: KillChainNameEnum

Closed enumeration of ATT&CK kill chain identifiers used in kill_chain_phases. These three values correspond to the three ATT&CK domains and are used to map techniques to their associated tactics. The phase_name in each kill_chain_phase must match the x_mitre_shortname of the corresponding x-mitre-tactic object.

URI: attack:KillChainNameEnum

Permissible Values

Value Meaning Description
mitre-attack None Enterprise ATT&CK kill chain (used in the enterprise-attack domain)
mitre-mobile-attack None Mobile ATT&CK kill chain (used in the mobile-attack domain)
mitre-ics-attack None ICS ATT&CK kill chain (used in the ics-attack domain)

Slots

Name Description
kill_chain_name The ATT&CK domain kill chain identifier

Identifier and Mapping Information

Schema Source

  • from schema: https://w3id.org/lmodel/attack

LinkML Source

name: KillChainNameEnum
description: Closed enumeration of ATT&CK kill chain identifiers used in kill_chain_phases.
  These three values correspond to the three ATT&CK domains and are used to map techniques
  to their associated tactics. The phase_name in each kill_chain_phase must match
  the x_mitre_shortname of the corresponding x-mitre-tactic object.
from_schema: https://w3id.org/lmodel/attack
rank: 1000
permissible_values:
  mitre-attack:
    text: mitre-attack
    description: Enterprise ATT&CK kill chain (used in the enterprise-attack domain).
  mitre-mobile-attack:
    text: mitre-mobile-attack
    description: Mobile ATT&CK kill chain (used in the mobile-attack domain).
  mitre-ics-attack:
    text: mitre-ics-attack
    description: ICS ATT&CK kill chain (used in the ics-attack domain).