Skip to main content
Skip table of contents

Add Tactics & Techniques to Incident

LAST UPDATED: AUG 29, 2024

Adds MITRE Tactics and Techniques to current incident.

READER NOTE

This command is only applicable within an Incident Playbook.

Implementation

System

Command Category

System Utility

Tags

INCIDENT

Inputs

Parameter Name

Required/Optional

Description

Sample Data

Tactics

Optional

The array of MITRE tactics (tactic IDs or tactic names) that to be added to the incident.

CODE
[
  "Persistence",
  "Privilege Escalation",
  "TA0005",
  "TA0043",
  "TA0042"
]

Techniques

Optional

The array of MITRE techniques (technique IDs or technique names) to be added to the incident.

CODE
[
  "Logon Scripts: Logon Script (Windows)",
  "Valid Accounts: Domain Accounts",
  "T1056.004",
  "Input Capture: Web Portal Capture",
  "Data Manipulation: Stored Data Manipulation"
]

Output

Return Data

The returned result of this command. If some required parameters are not defined, this returned data could be empty. The returned result can be passed down directly to a subsequent command in playbooks.

SAMPLE DATA

JSON
Successful
Context Data

The response data from the utility command.

SAMPLE DATA

JSON
[
    {
        "TacticMid": "TA0003",
        "TacticName": "Persistence",
        "TechniqueMid": "T1078.002",
        "TechniqueName": "Valid Accounts: Domain Accounts"
    },
    {
        "TacticMid": "TA0003",
        "TacticName": "Persistence",
        "TechniqueMid": "T1037.001",
        "TechniqueName": "Logon Scripts: Logon Script (Windows)"
    },
    {
        "TacticMid": "TA0004",
        "TacticName": "Privilege Escalation",
        "TechniqueMid": "T1078.002",
        "TechniqueName": "Valid Accounts: Domain Accounts"
    },
    {
        "TacticMid": "TA0004",
        "TacticName": "Privilege Escalation",
        "TechniqueMid": "T1037.001",
        "TechniqueName": "Logon Scripts: Logon Script (Windows)"
    },
    {
        "TacticMid": "TA0005",
        "TacticName": "Defense Evasion",
        "TechniqueMid": "T1078.002",
        "TechniqueName": "Valid Accounts: Domain Accounts"
    },
    {
        "TacticMid": "TA0042",
        "TacticName": "Resource Development",
        "TechniqueMid": "",
        "TechniqueName": "Unmapped"
    },
    {
        "TacticMid": "TA0043",
        "TacticName": "Reconnaissance",
        "TechniqueMid": "",
        "TechniqueName": "Unmapped"
    },
    {
        "TacticMid": "TA0040",
        "TacticName": "Impact",
        "TechniqueMid": "T1565.001",
        "TechniqueName": "Data Manipulation: Stored Data Manipulation"
    },
    {
        "TacticMid": "TA0006",
        "TacticName": "Credential Access",
        "TechniqueMid": "T1056.003",
        "TechniqueName": "Input Capture: Web Portal Capture"
    },
    {
        "TacticMid": "TA0009",
        "TacticName": "Collection",
        "TechniqueMid": "T1056.004",
        "TechniqueName": "Input Capture: Credential API Hooking"
    },
    {
        "TacticMid": "TA0006",
        "TacticName": "Credential Access",
        "TechniqueMid": "T1056.004",
        "TechniqueName": "Input Capture: Credential API Hooking"
    },
    {
        "TacticMid": "TA0009",
        "TacticName": "Collection",
        "TechniqueMid": "T1056.003",
        "TechniqueName": "Input Capture: Web Portal Capture"
    }
]
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.