The MITRE ATT&CK CDF integration provides feeds to ingest content from the MITRE Enterprise, Mobile, and ICS ATT&CK collections.

The CDF provides the following feeds:

• MITRE Enterprise ATT&CK - retrieves the content of the Enterprise ATT&CK collection. It retrieves a list of adversaries, intrusion set, course of actions, malware objects, attack partners and tools, along with their attributes.
• MITRE Mobile ATT&CK - retrieves the content of the Mobile ATT&CK collection. It retrieves a list of adversaries, intrusion set, course of actions, malware objects, attack partners and tools, along with their attributes.
• MITRE ICS ATT&CK - retrieves the content of the ICS ATT&CK collection. It retrieves a list of adversaries, intrusion set, campaigns, course of actions, malware objects, attack patterns and tools, along with their attributes.

The integration ingests the following system objects:

• Adversaries / Intrusion Sets
  • Adversary /Intrusion Set Attributes
• Attack Patterns
  • Attack Pattern Attributes
• Campaigns
• Course of Action
  • Course of Action Attributes
• Malware
  • Malware Attributes
• Tools
  • Tool Attributes