MITRE ATT&CK in QRadar: Reading the Attacker’s Map

Hi,

In this article I want to talk about one of the most discussed security frameworks of recent years, MITRE ATT&CK, and how we use it inside QRadar. My goal is to make one difference crystal clear: the gap between saying “there’s suspicious activity” and saying “this activity matches the Credential Dumping technique.”

In the previous article we covered the logic of analyzing an offense. MITRE ATT&CK is the last — and perhaps most valuable — link in that analysis.

What Is MITRE ATT&CK and What Does It Do?

MITRE ATT&CK is an open knowledge base that classifies attacker behaviors observed in the real world. In short, it puts what attackers do into a common language.

Let’s think about it. When an attacker breaks into a system, they don’t move randomly. First they do reconnaissance, then they gain a foothold, establish persistence, escalate privileges, and exfiltrate data. ATT&CK lays these steps out on a standard map.

The benefit of this map is this: you, another analyst on your team, and an expert on the other side of the world all describe the same event with the same words. That means speed and clarity.

An attacker doesn’t move at random; they follow a sequence of steps from reconnaissance to data exfiltration.

The Two Core Layers of the Framework

To understand MITRE ATT&CK, you only need two concepts.

Tactics — the “Why?”

A tactic is the attacker’s goal at a given moment. In other words, why is the attacker doing this? Examples:

• Initial Access: Gaining the first foothold in the system.
• Persistence: Maintaining access, opening a path back in.
• Privilege Escalation: Gaining higher privileges.
• Exfiltration: Getting data out.

Techniques — the “How?”

A technique is how the attacker reaches their goal. Each technique has a code. For example:

• T1110 — Brute Force: Cracking a password by trial and error.
• T1003 — Credential Dumping: Extracting password hashes from the system.

So an attack reads like “the T1110 technique under the Initial Access tactic.” This lets you compress an event into a single sentence.

A tactic defines the attacker’s goal (why); a technique defines the method (how).

How Does QRadar Use this Map?

The nice thing about QRadar is that it maps its rules to MITRE techniques. So when a rule fires, it doesn’t just produce an alert — it also tells you which technique that alert corresponds to.

You manage these mappings through Use Case Manager. Use Case Manager is the bridge that shows which techniques are covered by your rules.

The logic comes down to three points:

• Mapping: Your rules are associated with the relevant MITRE techniques.
• Heat Map: You see how well each technique is covered, using color. Dark colors mean strong coverage; faint ones mean weak or no coverage.
• Coverage analysis: The gaps on the map are the blind spots in your defense — the paths an attacker could take past you unseen.

The critical point here is this: the heat map is not a report card, it’s a road map. Every faint technique says “I should write a rule here.”

A Short Example

Say you saw a large number of failed logins on a user account in a short window, followed by a successful login. QRadar puts it into context like this:

Tactic:    Credential Access
Technique: T1110 - Brute Force
Rule:      "Multiple Failed Logins Followed by Success"

Now, instead of writing “suspicious login activity” in your report, you write “activity consistent with the T1110 Brute Force technique.” That tells your manager and the analyst on the next shift far more.

Practical Tips

• Start with high-risk tactics. Instead of trying to cover every technique, prioritize the most likely attack paths for your environment.
• Check the heat map regularly. Your coverage changes as you add new log sources.
• Don’t ignore the gaps. A faint technique could be the address of a future breach.
• Don’t obsess over the coverage percentage. There’s no such thing as 100% coverage; what matters is that the right techniques are covered.

Wrapping Up

MITRE ATT&CK is the most powerful common language an analyst has. It combines the attacker’s goal (tactic) and method (technique) on a single map, and QRadar lays that map in front of you with Use Case Manager and the heat map. Once you put this framework in place, you stop guessing at the gaps in your defense and start seeing them.

If you’d like to see this hands-on in QRadar, on the Use Case Manager itself, I cover this section end to end in my QRadar course on Udemy (Turkish narration with full English subtitles). Leaving it here in case it’s useful: QRadar SIEM Analyst: Analysis, Engineering and Threat Hunting.

In the next article, we’ll get into threat hunting with AQL.

Hope this was useful. See you in the next one.