The Cybersecurity and Infrastructure Security Agency (
CISA), in partnership with the Homeland Security Systems Engineering and Development Institute (
HSSEDI), has released
Decider, a tool for mapping adversary behavior to the MITRE ATT&CK
framework. HSSEDI is a federally funded research and development center
that is managed and operated by MITRE for the Department of Homeland
Security. HSSEDI worked with MITRE's ATT&CK team to develop Decider.
A companion to the recently updated Best Practices for MITRE ATT&CK Mapping Guide,
Decider helps network defenders, analysts, and researchers quickly and
accurately map adversary tactics, techniques, and procedures (TTPs) to
ATT&CK.
Decider makes ATT&CK mapping more accessible by walking users
through a series of guided questions about adversary activity. The new
tool helps cyber defenders determine correct tactics, techniques, or
sub-techniques that then inform a range of important activities such as
sharing the findings, discovering mitigations, and detecting further
techniques.
"The ATT&CK Framework is a proven approach to help organizations
more effectively prioritize cybersecurity controls and mitigations that
actively reduce the prevalence and impact of intrusions," said Eric
Goldstein, executive assistant director for cybersecurity, CISA. "We are
excited to continue our partnership with HSSEDI and MITRE in offering
the Decider tool to better guide ATT&CK mapping and help the
cybersecurity community accurately understand adversary activities and
make well-informed decisions that raise our collective defense."
"We are proud to partner with CISA to help cyber defenders take a more
adversary informed approach to protecting their networks," said Yosry
Barsoum, vice president and director, Center for Securing the Homeland
at MITRE. "With Decider, the greater cyber community will be better equipped to use ATT&CK."
Decider is a web application that must be hosted to be used.
Organizations can host Decider internally to save and share customized
mappings, questions, answers, and users per install. CISA does not offer
access to a running instance of Decider. Decider is currently
compatible with Enterprise ATT&CK versions 11.0 and 12.0.
Visit the
CISA GitHub site to download Decider.