CTI Analyst Field Manual | Andrey Pautov
Practical CTI-to-detection reference covering evidence labels, source reliability, ATT&CK mapping gates, hunting hypotheses, and detection backlog workflow.
- from
- Detection Engineering
- added
- 2026-10-10
- likes
- 0
similar
-
ThreatMapper | Andrey Pautov github.com
CTI-to-detection workbench for mapping threat reports to ATT&CK, comparing TTP overlap with groups and campaigns, identifying detection gaps, and exporting analyst-ready outputs.
-
DETT&CT: MAPPING YOUR BLUE TEAM TO MITRE ATT&CK™ mbsecure.nl
Outlines a methodology measuring security data visibility and detection coverage against the MITRE ATT&CK framework.
-
ATT&CK Navigator | MITRE mitre-attack.github.io
MITRE's open-source tool that can be used to track detection coverage, visibility, and other efforts and their relationship to the ATT&CK framework.
-
MITRE ATT&CK Data Sources Blog Post medium.com
MITRE describes various data sources and how they relate to the TTPs found in the MITRE ATT&CK framework.
-
MITRE ATT&CK attack.mitre.org
The foundational framework of adversary tactics, techniques, and procedures based on real-world observations.
-
Detection Engineering Field Manual | Zack Allen detectionengineering.net
a series of posts exploring the various foundational components of Detection Engineering.
Detection Engineering › General Resources: “Practical CTI-to-detection reference covering evidence labels, source reliability, ATT&CK mapping gates, hunting hypotheses, and detection backlog workflow.”