MITRE ATT&CK

Dashboard

Framework

Intelligence

Coverage

82%

5% this quarter

Techniques

194

mapped

Alerts Mapped

2,340

last 24h

Tactics Covered

10/14

of catalog

Technique	Tactic	Hits / 24h	Severity
T1059 — Command & Scripting	Execution	38	High
T1071 — C2 Protocols	Command & Control	27	High
T1021 — SMB Lateral	Lateral Movement	21	Medium
T1566 — Phishing	Initial Access	16	Medium
T1486 — Ransomware	Impact	9	Critical

Tactic	Techniques	Coverage	Detection
Reconnaissance	12	100%	Covered
Resource Development	8	75%	Partial
Initial Access	14	86%	Covered
Execution	18	94%	Covered
Persistence	16	69%	Partial
Privilege Escalation	17	82%	Covered
Defense Evasion	24	71%	Partial
Credential Access	15	87%	Covered
Discovery	13	92%	Covered
Lateral Movement	12	83%	Covered
Collection	10	80%	Covered
C2	9	78%	Partial
Exfiltration	7	71%	Partial
Impact	9	89%	Covered

Technique	Threat Cluster	Source	Updated
T1486 — Ransomware	Ryuk / LockBit	SYN SOAR Network	2h ago
T1071 — C2 Protocols	Conti lineage	Passive DNS feeds	5h ago
T1566 — Phishing	DocuSign lures	PhishTank	1d ago
T1110 — Brute Force	203.0.113.45	AbuseIPDB	30m ago

Ransomware behavior blocked on mail-01 CRITICAL

Playbook PB-041 auto-contained host · Ryuk TTPs matched

SSH brute force from 203.0.113.42 HIGH

42 failed logins in 60s · source IP blocked

Threat hunt matched T1059.001 on www-02

PowerShell obfuscation · confidence 0.91

14m

SCA scan completed on 128 hosts

98.2% compliance · 11 benchmarks passed

23m

Firewall rule 'BLK-3321' propagated to 14 nodes

0.4s propagation · geo-blocked 12 CIDRs

31m

Sandbox verdict — 'invoice_9921.exe' malicious

Heuristic score 96 · family 'Emotet'

44m