Mitre Classification
====================

ntopng offers in-depth insights into network performance and security, in fact
one of its powerful features is the ability to detect and trigger alerts related 
to network security issues. These alerts are mapped to the MITRE ATT&CK framework, 
a globally recognized knowledge base of adversary tactics and techniques. 
This integration enhances ntopng providing a structured understanding of the nature 
of these threats by associating them with specific MITRE ATT&CK IDs.
This section outlines how ntopng integrates with the MITRE ATT&CK framework and how 
users can navigate and interpret the related data within ntopng.

Mitre ATT&CK Framework Integration
----------------------------------

The MITRE ATT&CK framework is a curated knowledge base and model for cyber adversary 
behavior, including a comprehensive matrix of tactics, techniques, and procedures
that adversaries use. By mapping security alerts to specific ATT&CK IDs, ntopng 
allows users to understand the context of each alert in terms of the adversary's 
behavior and goals:

- Each security alert in ntopng is associated with a specific MITRE ATT&CK ID,
  providing context about the tactics and techniques used in the attack.
- Improved Incident Response: by understanding the ATT&CK ID associated with an alert,
  security teams can prioritize and respond more effectively based on the severity
  and nature of the threat.
- Comprehensive Security Reports: ntopng offers visual representations of the most
  common MITRE attacks, tactics, and techniques through a Security Report, allowing
  for a quick overview of the security landscape.

Security Report
---------------

The Security Report can be found in the Reports page, by selecting it from the list
or available reports in the dropdown. This report visually represent the distribution
of detected attacks, categorized by MITRE tactics, techniques, and specific ATT&CK IDs.
This allows users to quickly assess the most common types of attacks and their prevalence.
The Top Attacks are displayed for each classification, which are the most frequently
occurring attacks.

.. figure:: ../../../../img/security_report.png
   :align: center
   :alt: Security Report
  
   Security Report

Alerts Explorer
---------------

In the Alerts Explorer, each Flow or Host alert triggered by ntopng is displayed with
its corresponding MITRE ATT&CK classification (ID, tactic, technique). This section 
allows users to quickly identify the nature of the threat by referencing the associated 
ATT&CK ID.

Users can also filter alerts based on specific ATT&CK ID, tactic or technique, to focus 
on particular types of threats.

.. figure:: ../../../../img/alert_explorer_mitre_classification.png
   :align: center
   :alt: Mitre Classification in Alert Explorer
  
   Mitre Classification in Alert Explorer

Alert Details
---------------

Clicking on an alert (or a flow) ntopng will expand the view to show detailed information,
including the ATT&CK ID and the associated tactic description, for each of the flow status
and issue that contributed to trigger the alert.

.. figure:: ../../../../img/alert_details_with_mitre_classification.png
   :align: center
   :alt: Mitre Classification in Alert Details
  
   Mitre Classification in Alert Details
