Chapter 4: Mapping the Adversary
As we've explained previously, there is no threat hunting without good threat intelligence. Depending on the structure and the resources of your organization, you may have some threat intelligence reports that have already been processed for you. But either because you don't have a specialized intelligence team, or because you want to carry out some investigations by yourself, you need to know how to work with the MITRE ATT&CK Framework so that you can map your own intelligence reports.
In this chapter, we're going to cover the following topics:
- The ATT&CK Framework
- Mapping with ATT&CK
- Testing yourself
Let's get started!
