Attack Pattern Domain

Overview#

A security planner conducting a threat assessment for a government facility needs to model not just cyber intrusions but physical threats: surveillance drones, vehicle-borne devices, and insider-enabled access. Standard cyber frameworks do not cover those scenarios. The Attack Pattern domain does, combining the MITRE ATT&CK framework for cyber threats with a custom physical attack taxonomy, so both dimensions of a hybrid threat environment can be profiled in a single system.

Analysts map adversary tactics, techniques, and procedures (TTPs), track kill chain progression, and receive defensive countermeasure recommendations. All of this is cross-referenced across active investigations, revealing when the same techniques appear in multiple cases.

Interactive Architecture Topology

9 nodes8 signal paths

Select any node on the canvas or run Simulate Flow to trace upstream dependencies and downstream signal paths.

Entry points:

Key Features#

MITRE ATT&CK Integration: Maps to official MITRE ATT&CK tactic and technique identifiers for standardised cyber threat categorisation.
Physical Attack Taxonomy: Custom framework for physical security threats including reconnaissance, breach techniques, and explosive device attacks.
Kill Chain Mapping: Tracks attack patterns through Lockheed Martin Cyber Kill Chain phases from delivery through exploitation.
Defensive Countermeasure Mapping: Links attack techniques to defensive measures with relationship types (mitigates, detects) and effectiveness strength ratings.
Threat Profiling: Assesses adversary capabilities including sophistication level, target sectors, and known tool usage.
Investigation Linking: Connects attack patterns to active investigations for case-specific threat analysis.
Multi-Domain Coverage: Supports cyber, physical, and hybrid threat scenarios in a single system.
Defense-in-Depth Analysis: Maps multiple defensive layers against attack techniques for comprehensive security assessment.
Tactic Auto-Population: Automatically associates relevant tactics and techniques based on pattern configuration.
Control Type Classification: Categorises defences as preventive or detective with physical and technical control type indicators.

Use Cases#

Threat intelligence analysts profile cyber attack patterns using MITRE ATT&CK identifiers, enabling standardised communication and correlation across teams and partner organisations sharing intelligence under a Community of Interest agreement.

Physical security planners model threats against critical infrastructure facilities using the physical attack taxonomy, identifying appropriate vehicle barriers, inspection checkpoints, and surveillance countermeasures for each threat scenario.

Investigators link attack patterns to active cases to track adversary TTPs and identify connections between related incidents across separate investigations, particularly valuable when building attribution cases against organised threat groups.

Security architects query defensive mappings to identify the most effective countermeasures for specific attack techniques, building layered defence strategies based on confirmed adversary behaviour rather than generic best-practice checklists.

Kill chain analysts understand the progression of multi-stage attacks and identify optimal points for defensive intervention, stopping an adversary at the reconnaissance phase is less costly than responding after impact.

Integration#

The Attack Pattern domain integrates with the Threat Intelligence domain for intelligence ingestion, the Investigation domain for case management, the Entity Profile domain for structured profiling, and the MITRE ATT&CK framework for standardised technique identifiers.

Open Standards#

MITRE ATT&CK: Technique and tactic identifiers (e.g. T1003) are stored as first-class fields and synchronised monthly from the official MITRE CTI STIX repository, enabling standardised TTP profiling and cross-organisation intelligence sharing.
STIX 2.1 (OASIS): Attack pattern records are ingested and exported as STIX 2.1 attack-pattern Structured Threat Information Expression objects, ensuring interoperability with any STIX-capable threat intelligence platform.
TAXII 2.1 (OASIS): The platform polls remote TAXII 2.1 feeds to automatically ingest new attack pattern bundles, supporting continuous threat intelligence updates without manual import.
Lockheed Martin Cyber Kill Chain: Kill chain phases (reconnaissance through impact) are modelled as structured fields on each attack pattern profile, allowing analysts to pinpoint the stage of an adversary's intrusion sequence.
MITRE D3FEND: The physical defence technique catalogue follows the D3FEND countermeasure taxonomy, mapping defensive controls to attack techniques with typed relationships (mitigates, detects) and effectiveness ratings.
CAPEC (MITRE Common Attack Pattern Enumeration and Classification): Attack patterns on entity profiles may reference CAPEC identifiers, providing a common vocabulary for describing attack methods at the software and system level.
OAuth 2.0 and JWT Bearer Token: Token-based authentication protects typed, auditable read and write workflows across the platform.

Last Reviewed: 2026-02-05 Last Updated: 2026-04-14