Cyber Wiki Learning Path
MITRE ATT&CK® Foundations
Learn the ATT&CK data model, object relationships, matrix, platforms, defensive content, mapping methods, versioning, Navigator, assessments, and responsible coverage analysis.
Recommended Sequence
16 connected entries
MITRE ATT&CK® Coverage and Gap Analysis
How to measure coverage without equating a colored matrix cell with a validated detection or effective control.
Detection engineering method · IntermediateMITRE ATT&CK® Detection Strategies, Analytics, and Data Components
How defenders move from required observations to analytic logic, testing, tuning, ownership, and response-ready evidence.
Framework learning hub · All levelsMITRE ATT&CK® Educational Learning Center
A structured, versioned learning center that connects Enterprise ATT&CK adversary behavior to architecture, telemetry, detection, mitigation, investigation, recovery, and Bare Metal Cyber coursework.
Threat intelligence method · IntermediateMITRE ATT&CK® Groups, Software, Campaigns, and Procedure Examples
How ATT&CK connects named groups, malware, tools, campaigns, and evidence-backed procedure examples to techniques without treating labels as permanent truth.
Framework governance · IntermediateMITRE ATT&CK® Identifiers, Versioning, and Object Lifecycle
How stable identifiers, versions, modified dates, deprecation, and revocation support defensible mappings and repeatable maintenance.
Defensive architecture method · IntermediateMITRE ATT&CK® Mitigations and Defensive Design
How ATT&CK mitigation objects can inform layered control design while avoiding the false assumption that one mitigation universally stops a technique.
Framework scope · IntermediateMITRE ATT&CK® Platforms and Technology Scope
How ATT&CK platform metadata helps analysts distinguish Windows, Linux, macOS, cloud, identity, SaaS, containers, network devices, ESXi, and pre-compromise activity.
Framework methodology · IntermediateMITRE ATT&CK® Tactics, Techniques, Sub-techniques, and Procedures
How ATT&CK separates adversary goals, general behaviors, more specific behavior variants, and the observed procedures used in real operations.
Framework comparison · IntermediateMITRE ATT&CK®, the Cyber Kill Chain, and the Diamond Model
How three complementary models answer different questions about adversary behavior, operation progression, relationships, and analytic context.
Incident analysis method · IntermediateMapping Incidents to MITRE ATT&CK®
A disciplined method for mapping observed behavior to ATT&CK techniques, preserving evidence, confidence, scope, and the difference between an action and an inferred objective.
Framework structure · IntermediateThe MITRE ATT&CK® Data Model
How ATT&CK represents tactics, techniques, sub-techniques, relationships, detections, mitigations, groups, software, campaigns, and supporting references as connected objects.
Framework structure · IntermediateThe MITRE ATT&CK® Enterprise Matrix
How the Enterprise matrix organizes observed adversary behaviors by tactical objective without turning the matrix into a checklist of products.
Analyst tool guide · IntermediateUsing MITRE ATT&CK® Navigator
How Navigator layers can visualize threat intelligence, detection coverage, red-team plans, assessment results, and prioritized engineering work without misrepresenting uncertainty.
Detection engineering method · IntermediateUsing MITRE ATT&CK® for Detection Engineering
How to translate behaviors into hypotheses, data requirements, analytics, tests, tuning criteria, response actions, and measurable coverage.
Assessment method · IntermediateUsing MITRE ATT&CK® for Security Assessments
How to evaluate whether people, processes, architecture, controls, and telemetry can prevent, observe, investigate, and recover from relevant behaviors.
Threat modeling method · IntermediateUsing MITRE ATT&CK® for Threat Modeling
How architecture teams can use relevant adversary behaviors to test trust boundaries, abuse cases, telemetry, and resilience decisions.