Quick Ref: ATT&CK Triage
Recall behavior-first ATT&CK triage prompts for a SOC alert.
TACTIC Use TACTIC before attribution IOC-first note versus behavior-first note Behavior-first notes create better scoping work. Objection: 'The vendor says this is a known group.' The vendor says this is a known group, so can I put the actor in the title? SOC line Use the actor note as context, but title the case by observed behavior until we have corroborating evidence. Actor-first language can bias scoping and make weak evidence sound confirmed. It keeps ATT&CK useful as behavior language while preserving attribution caution. What is the first scoping question after mapping persistence? Where else is the same persistence mechanism,…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in