A better way to visualize, filter and search MITRE ATT&CK matrix
This program exports MITRE ATT&CK enterpise matrix into a ELK dashboard. Check out this blog post entry for having better understanding on the benefits of exporting the ATT&CK enterprise matrix into ELK.
Visualizing the relationship between MITRE ATT&CK Tactics, Techniques, Groups and Software
Filtering out by MITRE ATT&CK Techniques
- Clone or fork this repo email@example.com:michaelhidalgo/attack-to-elk.git
- Create a virtual environment using virtualenv:
- Activate the virtual environment running source env/bin/activate from the root folder.
- Install dependencies from requirements file pip3 install -r requirements.txt
- Export following environment variables with Elasticsearch IP address and port:
export es_hostname='Your ELK IP' export es_port='Your ELK port (9200 by default)'
- Run the program using Python3:
Importing ELK artifacts
All visualizations, index patterns and dashboards were exported into an artifact JSON file.
Once you've run the script and indexing the matrix, you can go to Kibana Management -> Saved Objects and Import. From there you can choose the artifacts JSON described above and that's it.