Scope, influences and mappings

The schema models ATT&CK v20.0 as MITRE publishes it in STIX 2.1:

• the knowledge: techniques, tactics, groups, campaigns, software, mitigations and assets;
• detection: detection strategies, analytics, data components and the deprecated data sources;
• the structure: matrices, collections, relationships, MITRE’s identity and marking, and the bundle.

Every object of the three bundles validates against it.¹

Nothing shaped it beyond ATT&CK and its data model. Its release asset and governance files follow lmodel/slsa. It maps nothing itself: ATT&CK’s classes are STIX’s, and is_a says so. The stix modules carry their own mappings to the Unified Cyber Ontology.¹

It leaves out:

• other ATT&CK releases and the STIX 2.0 form;
• the collection index index.json, Navigator layers and the other files MITRE publishes beside the bundles;
• the cyber-observable objects, which come with the stix modules but which ATT&CK does not use.²

Footnotes

Section titled “Footnotes”

1. README.md, the What it models, Influences and Mappings sections ↩ ↩²

2. docs/about.md, the What is left out section ↩