Analyzing and visualizing cyberattacks using Attack Flow

As written in my previous posts, the ATT&CK Navigator is a great tool to identify, highlight and prioritize TTPs based on relevant threat actors, data sources or tooling.

However, if we want to analyze or showcase specific attack chains or courses of action during a cyberattack the ATT&CK Navigator might not be the best tool to do so. Actual cyberattacks won’t necessarily follow a linear course of action. For example, attackers will likely restart their “Reconnaissance” efforts once they …

action amp att attack attack chains courses cyberattack cyberattacks cybersecurity data data sources flow great identify information security information technology navigator posts relevant risk management threat threat actors threat intelligence tool tooling ttps written