Add Tactics & Techniques to Incident

Last updated: Aug 29, 2024

Adds MITRE Tactics and Techniques to current incident.

READER NOTE

This command is only applicable within an Incident Playbook.

Implementation	System
Command Category	System Utility
Tags	Incident

Inputs

Parameter Name	Required/Optional	Description	Sample Data
Tactics	Optional	The array of MITRE tactics (tactic IDs or tactic names) that to be added to the incident.	`[ "Persistence", "Privilege Escalation", "TA0005", "TA0043", "TA0042" ]`
Techniques	Optional	The array of MITRE techniques (technique IDs or technique names) to be added to the incident.	`[ "Logon Scripts: Logon Script (Windows)", "Valid Accounts: Domain Accounts", "T1056.004", "Input Capture: Web Portal Capture", "Data Manipulation: Stored Data Manipulation" ]`

Output

Return Data

The returned result of this command. If some required parameters are not defined, this returned data could be empty. The returned result can be passed down directly to a subsequent command in playbooks.

Sample Data

JSON

Successful

Context Data

The response data from the utility command.

Sample Data

JSON

[
    {
        "TacticMid": "TA0003",
        "TacticName": "Persistence",
        "TechniqueMid": "T1078.002",
        "TechniqueName": "Valid Accounts: Domain Accounts"
    },
    {
        "TacticMid": "TA0003",
        "TacticName": "Persistence",
        "TechniqueMid": "T1037.001",
        "TechniqueName": "Logon Scripts: Logon Script (Windows)"
    },
    {
        "TacticMid": "TA0004",
        "TacticName": "Privilege Escalation",
        "TechniqueMid": "T1078.002",
        "TechniqueName": "Valid Accounts: Domain Accounts"
    },
    {
        "TacticMid": "TA0004",
        "TacticName": "Privilege Escalation",
        "TechniqueMid": "T1037.001",
        "TechniqueName": "Logon Scripts: Logon Script (Windows)"
    },
    {
        "TacticMid": "TA0005",
        "TacticName": "Defense Evasion",
        "TechniqueMid": "T1078.002",
        "TechniqueName": "Valid Accounts: Domain Accounts"
    },
    {
        "TacticMid": "TA0042",
        "TacticName": "Resource Development",
        "TechniqueMid": "",
        "TechniqueName": "Unmapped"
    },
    {
        "TacticMid": "TA0043",
        "TacticName": "Reconnaissance",
        "TechniqueMid": "",
        "TechniqueName": "Unmapped"
    },
    {
        "TacticMid": "TA0040",
        "TacticName": "Impact",
        "TechniqueMid": "T1565.001",
        "TechniqueName": "Data Manipulation: Stored Data Manipulation"
    },
    {
        "TacticMid": "TA0006",
        "TacticName": "Credential Access",
        "TechniqueMid": "T1056.003",
        "TechniqueName": "Input Capture: Web Portal Capture"
    },
    {
        "TacticMid": "TA0009",
        "TacticName": "Collection",
        "TechniqueMid": "T1056.004",
        "TechniqueName": "Input Capture: Credential API Hooking"
    },
    {
        "TacticMid": "TA0006",
        "TacticName": "Credential Access",
        "TechniqueMid": "T1056.004",
        "TechniqueName": "Input Capture: Credential API Hooking"
    },
    {
        "TacticMid": "TA0009",
        "TacticName": "Collection",
        "TechniqueMid": "T1056.003",
        "TechniqueName": "Input Capture: Web Portal Capture"
    }
]