PSC: How to get more information on MITRE TTPs

[#1]

Environment

• Predictive Security Cloud (PSC): February 18, 2020 Release (0.52.1 backend)
  • Cloud Endpoint Standard (fka CB Defense)
  • Cloud Enterprise EDR (fka CB ThreatHunter)
  • CB ThreatSight 

Objective

Provide steps to view details on MITRE ATT&CK framework TTPs on the Alerts page

Resolution

1. Go to Alerts page
2. Click into Search bar
3. Begin typing MITRE to view list of related TTPs
4. Select desired MITRE TTP and press Enter to search

   Example
   TTP:MITRE_T1075_PASS_THE_HASH

5. Expand items displayed to view full list of TTPs linked to selected AlertID
6. Click on the pill/button with desired MITRE TTP listed
7. New tab opens in browser with information on MITRE technique or tactic

   Example
   https://attack.mitre.org/techniques/T1075/

Additional Notes

Repeat as desired for other MITRE TTPs or use the MITRE site (MITRE ATT&CK®) to look for information on other Tactics, Techniques, and Procedures (TTPs)

Related Content

https://community.carbonblack.com/t5/Console-Release-Notes/tkb-p/release_notes#February18
Cb Defense: Alert ID vs. Threat ID
Carbon Black Cloud: How to Dismiss Alerts