The Sightings Ecosystem gives cyber defenders visibility into what adversaries are actually doing in the wild. With your help, we are tracking MITRE ATT&CK® techniques observed to give defenders real data on technique prevalence. With this data, we can analyze trends in evolving adversary behaviors, and ultimately provide a data-driven resource to support prioritizing defensive operations. This project ingests ATT&CK technique sightings and process them to produce useful datasets and reporting.
You can be a part of the success of this project by contributing your Sightings data and help advance the state of cybersecurity at large. To join us, please submit a Data Contributor Request form.
To get started, we suggest skimming the documentation to get familiar with the project. Next, you may want to try creating your own attack flows using the Attack Flow Builder, which is an easy-to-use GUI tool. When you are ready to dive deep, review the Example Flows and JSON Schema for the language.
| Resource | Description |
|---|---|
| Project Web Site | Complete documentation for the Sightings Ecosystem. |
| Sightings Data | Download the underlying Sightings data. (CSV – 25.7MiB) |
| Data Contributor Request | Become a data contributor. |
| Upload Tool | A tool for automatically submitting sightings data (supports Linux, MacOS, and Windows). |
Defenders need data driven answers to questions like:
We believe that a different type of cyber threat intelligence must be shared in order to serve this purpose, and the Center is well-positioned to work across industry. Specifically, security teams, vendors, ISACs/ISAOs, and governments should begin to share sightings of ATT&CK techniques. In other words, they should share when they see adversaries use specific behaviors against real production systems and networks.
Please submit issues on GitHub for any technical questions or requests. You may also contact ctid@mitre-engenuity.org directly for more general inquiries about the Center for Threat-Informed Defense.
We welcome your contributions to help advance Sightings Ecosystem in the form of pull requests. Please review the contributor notice before making a pull request.
Copyright 2021, 2024 MITRE Engenuity. Approved for public release. Document number(s) CT0022, CT0103.
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
This project makes use of MITRE ATT&CK®