MITRE ATT&CK is a public knowledge base that organizes the tactics and techniques real attackers use, from how they get in to how they steal information. Security teams use it as a common language to design detections, evaluate tools and measure how well their defenses are covered.
How TecnetOne handles it: TecnetSOC
MITRE ATTACK, ATT&CK matrix, tactics and techniques, ATT&CK framework
Related terms
Threat intelligence
Threat intelligence is collected and analyzed information about who is attacking, with which techniques and against what kind of companies, so you can get ahead of attacks instead of only reacting. It includes indicators such as malicious IP addresses or domains and context on active campaigns that affect your industry or region.
Defense in depth
Defense in depth is a strategy that protects a company with several independent layers of security, so if one fails another stops the attack. It combines, for example, firewall, MFA, antivirus, network segmentation, backups and monitoring, the same way a castle combines walls, a moat and guards.
Incident response
Incident response is the organized process a company uses to detect, contain, eliminate and recover from an attack or security failure, so it limits the damage and gets back to normal operations quickly. It follows defined phases: preparation, identification, containment, eradication, recovery and lessons learned.
SNMP and NetFlow
SNMP (Simple Network Management Protocol) lets you check the status of routers, switches, servers and printers, such as CPU usage or whether an interface went down. NetFlow records who talks to whom on the network and how much traffic they send. Together they are the foundation of a NOC's network monitoring.
Logs (event logs)
Logs, or event logs, are the files where systems, applications and network devices automatically record what happens: sign-ins, errors, configuration changes or connections. In cybersecurity they are the evidence used to detect attacks and investigate incidents, which is why they are centralized in a SIEM and kept for a defined period.
Ready to put this into practice in your operation?
Tell us what you need and a TecnetOne engineer will get back to you.
Talk to an engineerTalk to an engineer
Tell us what you need and we’ll reply the same business day.