Cyber Adversary Framework Mapping Application

With the Cyber Adversary Framework Mapping Application (included in Version 2.5.3 and earlier,) you can map your custom rules to MITRE ATT&CK tactics and techniques and override the IBM® default rule mappings.

With 2.6.0, the QRadar® Use Case Manager is installed with QRadar Advisor with Watson™ and the QRadar Use Case Manager version is updated to 2.3.1. The QRadar Use Case Manager includes MITRE ATT&CK mapping and visualization. For more information, see QRadar Use Case Manager.
Note: If you already have a version of QRadar Use Case Manager installed, it will either upgrade the app or do nothing if your current version is the same or newer.
Important: The QRadar Use Case Manager is only installed after you configure the Advisor app with an authorized service token. Creating authorized service tokens.
Attention: If you are using QRadar Advisor with Watson 2.5.3 or earlier, then you can use the Cyber Adversary Framework Mapping Application app that is included with QRadar Advisor with Watson. Do not use both the Use Case Manager and the Cyber Adversary Framework Mapping Application at the same time or you will encounter out of sync issues.

The QRadar Advisor with Watson app automatically maps MITRE ATT&CK tactics and techniques to CRE rules. The tactics are identified from IBM X-Force and Detect behavior (tactics rule behavior). In the QRadar Advisor with Watson app, you can see the tactics that are identified for an offense investigation, a search, and the offense details pane.

The following content pack contains techniques: IBM QRadar Content Extension for Sysmon . You must install the Sysmon content pack to add sysmon rules and you must also have sysmon log sources. When the Cyber Adversary Framework Mapping Application downloads its default mappings from the cloud, it will see that those rules are in QRadar and add them instead of discarding.

Note: The Cyber Adversary Framework Mapping Application and MITRE ATT&CK tactics and techniques are available in QRadar Advisor with Watson.

The MITRE ATT&CK framework represents adversary tactics that are used in a security attack. The following phases of an attack are represented:

MITRE ATT&CK Tactic Description
Initial Access Gains entry to your environment.
Execution Run malicious code.
Persistence Maintain foothold.
Privilege Escalation Gain higher-level permissions.
Defense Evasion Avoid detection.
Credential Access Steal login and password information.
Discovery Figure out your environment.
Lateral Movement Move through your environment.
Collection Gather data.
Exfiltration Steal data.
Command and Control Contact controlled systems.