Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[UX Copy] Security Mitre Attack detection coverage page. #3495

Closed
ARWNightingale opened this issue Jun 27, 2023 · 1 comment
Closed

[UX Copy] Security Mitre Attack detection coverage page. #3495

ARWNightingale opened this issue Jun 27, 2023 · 1 comment
Assignees
Labels
Effort: Medium Issues that take moderate but not substantial time to complete Feature: Rules Priority: Medium Issues that have relevance, but aren't urgent Team: Detections/Response Detections and Response ui-copy v8.10.0

Comments

@ARWNightingale
Copy link

Summary
When users start using Security Solution and detection rules, they want to understand and keep track of the coverage the Solution can provide. Currently we provide them with Rules in a table that can be sorted and filtered, but there is no overview that can give an understanding about coverage at a glance.
Different teams worked around this problem by building their custom tools as referenced in the Related Epics.

The popular way to represent coverage is using MITRE ATT&CK(TM) framework. It is a knowledge base of adversary tactics and techniques based on real-world observations. Currently it consists of 14 Tactics, 191 Techniques and 385 Sub-techniques. It is used by different teams and tools as a common reference.

Tactics represent an adversary tactical goal (eg Credential access), and in general can be viewed as an attack progression stages. Techniques represent how the attacker is achieving their goal.

We map our pre-built protections to ATT&CK tactics/techniques/sub-techniques where applicable. When creating custom rules, users can also map them to ATT&CK.

By coverage we usually understand the availability and number of detections for a given tactic/technique.

Request
We would like to review the UX copy in the UI. We have a quick description of the page under the page title and a reference to the docs page. This docs page would need to be created.

Additional information

Related Epic

Design

@jmikell821 jmikell821 added Team: Detections/Response Detections and Response Feature: Rules ui-copy v8.10.0 Priority: Medium Issues that have relevance, but aren't urgent Effort: Medium Issues that take moderate but not substantial time to complete labels Jun 28, 2023
@joepeeples
Copy link
Contributor

UX copy revised in elastic/kibana#164613, no further changes at this time so closing this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Effort: Medium Issues that take moderate but not substantial time to complete Feature: Rules Priority: Medium Issues that have relevance, but aren't urgent Team: Detections/Response Detections and Response ui-copy v8.10.0
Projects
None yet
Development

No branches or pull requests

3 participants