Skip to content
attack

Explanations

  • Element names and the shared namespace nobody has checked this yet, still a draft
    Why classes and enums carry the Attack prefix while slots keep the keys MITRE’s data writes, which keys the adapt copy shares with lmodel/stix’s copy and the released neighbours’ copies, and why no class is shared.

  • Scope, influences and mappings nobody has checked this yet, still a draft
    What the schema models (ATT&CK v20.0’s objects across the Enterprise, Mobile and ICS domains), what it leaves out, what shaped it (ATT&CK and its data model alone) and why it maps nothing itself.

  • Where the data departs from the ATT&CK Data Model nobody has checked this yet, still a draft
    The six places where MITRE’s v20.0 data departs from the ATT&CK Data Model v4.11.7, which the schema follows the data on: two tactic short names, a platform, revoked techniques without kill chain phases, retired techniques with their domain’s source name, deprecated mitigations with a technique’s ID, and a malware revoked by a tool. Also the 44 places where the data breaks a statement of the ADM’s documentation across a bundle: sub-techniques without a parent or on a platform their parent lacks, and log source references to a log or data component that is not there.