MITRE ATT&CK Integration

Suricatavel natively integrates with the MITRE ATT&CK® framework. This integration correlates active Suricata rules and ingestion alerts with real-world adversarial tactics and techniques. Security teams can analyze defensive posture, identify detection gaps, and visualize threat coverage directly from the dashboard.

---

How the mapping works

Suricatavel dynamically tracks and correlates attacks through two automated layers:

• Rule Metadata Scanning: Suricata rules often contain structured metadata references (e.g., tag mitre_technique_id T1059). Suricatavel parses these tags and maps rules to specific techniques in the local database.
• Alert Correlation: When an alert fires, Suricatavel inherits the rule’s MITRE mapping. This automatically decorates the alert payload with the technique ID, tactic category, and links to the official MITRE wiki.

---

Bootstrapping MITRE ATT&CK (CLI Setup)

To activate MITRE correlation, import the attack matrix and compile mappings for your rules:

1. Import the MITRE Matrix: Download and ingest the latest official Enterprise STIX 2.1 bundle from MITRE:

   php artisan mitre:import

   (Optional) To use a local file or custom STIX server, supply the --source option:

   php artisan mitre:import --source=/path/to/enterprise-attack.json

2. Map Existing Rules: Scan all active Suricata rules and link them to their corresponding imported techniques:

   php artisan mitre:map-rules

   (Optional) To map rules belonging only to a specific threat feed:

   php artisan mitre:map-rules --feed="Emerging Threats"

Tip

Automating rule updates: When you create or import new rules via the rule manager, Suricatavel automatically triggers background jobs to parse and map any metadata tags. Re-running mitre:map-rules is only necessary to rebuild legacy or bulk-edited feeds.

---

Visualizing threat coverage

Once the matrix and rules are linked, Suricatavel provides visual analysis tools:

The MITRE coverage widget

Located on the main security dashboard, this heat-map widget provides:

• Tactic distribution: Grouped view of active rules across core tactics (e.g., Initial Access, Execution, Persistence, Exfiltration).
• Technique hotspots: Highlights which techniques have the highest coverage of active rules.
• Alert hotspots: Overlays live alerts onto the matrix, pinpointing which techniques are currently active in your infrastructure.

---

Troubleshooting and validation

To verify the state of your MITRE database and rules:

Inspect active techniques

To verify that techniques are correctly loaded in the database, query the count directly:

# Verify the total number of techniques and network-detectable capabilities
php artisan mitre:import --source=https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json

Check database schema

You can inspect rules and alerts to confirm technique fields are populated:

• Rules Table: Inspect details of a rule to check if the MITRE Techniques chip array displays associated techniques (e.g., T1043 - Commonly Used Port).
• Alert Infolist: Open an alert to view its threat categorization, technique link, and associated tactic.