ATT&CK domain

Glossary termreferenceglossary/attack-domain

Nobody has checked this yet

still a draft

Written 2026-10-31 by ktl-librarian (automation).

One of ATT&CK's three technology domains: Enterprise, Mobile or ICS.

The full record

Checks

none recorded

Sources

src/attack/schema/attack.yaml

Related to

attack LinkML schema

Defined by

ATT&CK Data Model

Graph

Open this concept in the knowledge graph

IRI

https://w3id.org/lmodel/attack/knowledge/glossary/attack-domain

Licence

CC BY 4.0

Files

Markdown JSON-LD Source on GitHub History on GitHub

ATT&CK domain

An ATT&CK object names its domains in x_mitre_domains: enterprise-attack, mobile-attack or ics-attack. Each domain has a kill chain, named mitre-attack, mitre-mobile-attack or mitre-ics-attack in a kill chain phase, and a matrix (AttackMatrix), which lists its tactics in order in tactic_refs. MITRE publishes each release of a domain as one bundle.¹

src/attack/schema/attack.yaml, the class AttackMatrix ↩

ATT&CK domain

ATT&CK domain

Footnotes