mitre att&ck
Help articles tagged “mitre att&ck”.
Reading the ATT&CK tab: incidents and kill-chain tactics
The ATT&CK tab fuses warning signs from a parent program and the programs it launched into one incident, scores it by how many attack stages it spans, and maps it on a 12-tactic matrix.
The Detections tab: what a risk score means
The Detections tab scores each program that is online right now from 0 to 100 by adding up warning signs it shows. At 40 or more it is worth a look, but a score is a lead, not a verdict.
Stop alerts for trusted apps and publishers
Add a program by path, or a whole publisher, under Security ▸ App whitelist…. Whitelisted apps are no longer risk-scored, so they stop raising suspicious-process alerts and incidents.
Threat intelligence and behavioral detection
NetSecWall checks every remote address against six public threat lists, and separately scores each program's behavior from 0 to 100. Lists catch known-bad addresses; behavior catches new ones.