Glossary

• Analytic nobody has checked this yet, still a draft
  In ATT&CK, the detection logic for one platform, with the logs it reads and the parts a defender may tune. The schema renders it as AttackAnalytic, an x-mitre-analytic object with an ATT&CK ID of AN and four digits.

• Asset nobody has checked this yet, still a draft
  In ATT&CK for ICS, a device or system in an industrial control system that techniques target. The schema renders it as AttackAsset, an x-mitre-asset object with an ATT&CK ID of A and four digits.

• ATT&CK domain nobody has checked this yet, still a draft
  One of ATT&CK’s three technology domains, Enterprise, Mobile and Industrial Control Systems (ICS), each a separate knowledge base with its own matrix and kill chain. The schema renders them as the values of AttackDomain and each matrix as AttackMatrix.

• ATT&CK ID nobody has checked this yet, still a draft
  The human-readable identifier ATT&CK gives an object, such as T1059 or TA0001, carried in the first of its external references; distinct from its STIX identifier, a type name and a UUID.

• Campaign nobody has checked this yet, still a draft
  In ATT&CK, intrusion activity over a stated period against common targets. The schema renders it as AttackCampaign, a STIX campaign with an ATT&CK ID of C and four digits and the sources for when it was first and last seen.

• Data component nobody has checked this yet, still a draft
  In ATT&CK, a specific kind of data that can reveal a technique, such as process creation, with the logs that hold it. The schema renders it as AttackDataComponent, with an ATT&CK ID of DC and four digits; the data sources that grouped components are deprecated.

• Detection strategy nobody has checked this yet, still a draft
  In ATT&CK, an approach to detecting a technique, carried out by analytics, one for each platform. The schema renders it as AttackDetectionStrategy, an x-mitre-detection-strategy object with an ATT&CK ID of DET and four digits.

• Group nobody has checked this yet, still a draft
  In ATT&CK, a set of related intrusion activity the security community tracks under a name. The schema renders it as AttackGroup, a STIX intrusion-set with an ATT&CK ID of G and four digits.

• Mitigation nobody has checked this yet, still a draft
  In ATT&CK, a security concept or class of technology that can stop a technique from succeeding. The schema renders it as AttackMitigation, a STIX course-of-action with an ATT&CK ID of M and four digits that mitigates techniques.

• Software nobody has checked this yet, still a draft
  In ATT&CK, code an adversary uses, as malware or as a tool. The schema renders the two as AttackMalware and AttackTool, STIX malware and tool objects that share an ATT&CK ID of S and four digits and give their other names in x_mitre_aliases.

• Tactic nobody has checked this yet, still a draft
  In ATT&CK, an adversary’s goal, the reason for a technique, such as initial access. The schema renders it as AttackTactic, an x-mitre-tactic object with an ATT&CK ID of TA and four digits and a short name that techniques’ kill chain phases use.

• Technique nobody has checked this yet, still a draft
  In ATT&CK, a way an adversary reaches a tactic’s goal; a sub-technique is a narrower way. The schema renders both as AttackTechnique, a STIX attack-pattern with an ATT&CK ID of T and four digits, and a sub-technique’s adds a full stop and three digits.