The "Create Att&ck Layer from TTP List" workflow template is designed to streamline threat intelligence analysis by converting a list of MITRE ATT&CK Tactics and Techniques into a visual layer. This workflow receives TTPs, enriches tactics when techniques are missing, and generates an ATT&CK layer in both JSON and SVG formats. Ideal for CSPM, Case Management, and Threat Hunting, it enhances visibility into potential threats, allowing security teams to visualize and prioritize their response strategies effectively.
Optional Triggers
["Use this workflow as a nested function."]
Use Cases
CSPM , Case Management , DSPM , Function , Threat Hunting
Workflow Breakdown
Receives a list of Tactics (TA0002) and Techniques (T1028)
Enrich Tactics when Techniques are not found.
Highlight techniques and sub techniques in the Att&ck Layer.
Creates a Layer in JSON format.
Converts JSON Layer to SVG image.
Vendors
Scripting, Utils
Workflow Output
Output contains Att&ack Layer in JSON format and Base64 encoded SVG image.
Tips
Use a Quick Action from a case to automatically attach layers when doing Threat Hunting.