Cybersecurity

CISA Releases New Tool Mapping Adversary Behavior to MITRE ATT&CK

Critical Infrastructure Colleagues and Partners, 

As the nation’s cyber defense agency, the Cybersecurity and Infrastructure Security Agency (CISA), in partnership with the Homeland Security Systems Engineering and Development Institute™ (HSSEDI), have released Decider, a tool for mapping adversary behavior to the MITRE ATT&CK^® framework. HSSEDI is a federally funded research and development center (FFRDC) that is managed and operated by MITRE for the Department of Homeland Security (DHS). HSSEDI worked with MITRE’s ATT&CK team to develop Decider. 

A companion to the recently updated Best Practices for MITRE ATT&CK^® Mapping Guide, Decider helps network defenders, analysts, and researchers quickly and accurately map adversary tactics, techniques, and procedures (TTPs) to ATT&CK.  

Decider makes ATT&CK mapping more accessible by walking users through a series of guided questions about adversary activity. The new tool helps cyber defenders determine correct tactics, techniques, or sub techniques, which then inform a range of important activities such as sharing the findings, discovering mitigations, and detecting further techniques.   

Visit the CISA GitHub site to download Decider. To learn more about the capabilities of this tool, refer to CISA’s technical blog.  

Your support to amplify this CSA through your communications and social media channels is appreciated. As always, thank you for your continued collaboration.