diff --git a/README.md b/README.md index 8123c47..408d6ee 100644 --- a/README.md +++ b/README.md @@ -30,6 +30,13 @@ methodologies, defines all the key terms, and contains detailed examples. | [Navigator Layers](https://github.com/center-for-threat-informed-defense/sensor-mappings-to-attack/tree/main/mappings/layers/enterprise) | ATT&CK Navigator views of the Sensor Mappings. | | [STIX Bundles](https://github.com/center-for-threat-informed-defense/sensor-mappings-to-attack/tree/main/mappings/stix/enterprise) | Machine-readable list of Sensor Mappings. | +The initial SMAP work was developed using ATT&CKv13.1. The mappings include some data +components that are not represented in ATT&CKv13.1 and may not be represented in more +recent versions of ATT&CK. The reason for this is that ATT&CK does not include data +components that do not currently have a relationship to a (sub-)technique. These +mapped data components are being tracked by the ATT&CK team and will be considered for +incorporation in future versions of ATT&CK as the overall ATT&CK catalog evolves. + ## Getting Involved There are several ways that you can get involved with this project and help advance diff --git a/docs/example_technique_mappings/index.rst b/docs/example_technique_mappings/index.rst index 561d594..c145b2a 100644 --- a/docs/example_technique_mappings/index.rst +++ b/docs/example_technique_mappings/index.rst @@ -18,3 +18,10 @@ looking to provide insight into a specific environment. linux cloudtrail network + +Note that the initial SMAP work was developed using ATT&CKv13.1. The mappings include +some data components that are not represented in ATT&CKv13.1 and may not be represented +in more recent versions of ATT&CK. The reason for this is that ATT&CK does not include +data components that do not currently have a relationship to a (sub-)technique. These +mapped data components are being tracked by the ATT&CK team and will be considered for +incorporation in future versions of ATT&CK as the overall ATT&CK catalog evolves. \ No newline at end of file diff --git a/docs/levels/index.rst b/docs/levels/index.rst index 736b5ea..a76b316 100644 --- a/docs/levels/index.rst +++ b/docs/levels/index.rst @@ -6,6 +6,13 @@ which gather data from endpoints in the environment (e.g., Windows, Linux), and Sensors, which gather data gather from network communications, typically outbound connections. +The initial SMAP work was developed using ATT&CKv13.1. The mappings include some data +components that are not represented in ATT&CKv13.1 and may not be represented in more +recent versions of ATT&CK. The reason for this is that ATT&CK does not include data +components that do not currently have a relationship to a (sub-)technique. These +mapped data components are being tracked by the ATT&CK team and will be considered for +incorporation in future versions of ATT&CK as the overall ATT&CK catalog evolves. + View Mappings ------------- diff --git a/docs/methodology/step2.rst b/docs/methodology/step2.rst index d5e2634..c310a40 100644 --- a/docs/methodology/step2.rst +++ b/docs/methodology/step2.rst @@ -50,6 +50,13 @@ pages provide definitions for each individual Data Source. .. image:: ../_static/attack_ex_pc.png :width: 600 +Note that the initial SMAP work was developed using ATT&CKv13.1. The mappings include +some data components that are not represented in ATT&CKv13.1 and may not be represented +in more recent versions of ATT&CK. The reason for this is that ATT&CK does not include +data components that do not currently have a relationship to a (sub-)technique. These +mapped data components are being tracked by the ATT&CK team and will be considered for +incorporation in future versions of ATT&CK as the overall ATT&CK catalog evolves. + For Process Creation, ATT&CK's definition is : **..the initial construction of an executable..**. Through key word review, it can be determined that this is the same as **..a process is created..** Therefore, event ID 4688 can be linked with this ATT&CK diff --git a/docs/overview.rst b/docs/overview.rst index 433577d..1653ee3 100644 --- a/docs/overview.rst +++ b/docs/overview.rst @@ -16,6 +16,13 @@ to answer questions such as: - If I'm concerned about a recent threat report, how can I look for that threat in my environment? +The initial SMAP work was developed using ATT&CKv13.1. The mappings include some data +components that are not represented in ATT&CKv13.1 and may not be represented in more +recent versions of ATT&CK. The reason for this is that ATT&CK does not include data +components that do not currently have a relationship to a (sub-)technique. These +mapped data components are being tracked by the ATT&CK team and will be considered for +incorporation in future versions of ATT&CK as the overall ATT&CK catalog evolves. + Background ----------