>> Now that you've learned a little bit about how to
express in store ATT&CK mapped Intel and information,
we can move on to learning how to
utilize an important tool for
analyzing that data for our CTI analysis process.
We call this tool the ATT&CK Navigator.
The ATT&CK Navigator is designed to provide
basic navigation and annotation of the ATT&CK matrices.
We're going to practice using it here.
Our objectives for lesson 3.3
include learning how to review
the ATT&CK navigator's basic applications features as
well as how to prioritize techniques
from these different groups that we encounter.
Here, we can see a navigator layer in which
the group APT28 has been selected.
What this does is it uses data currently mapped in
the Mitre ATT&CK framework to show
all the TTP is associated with APT28.
The highlighted TTP is for APT28 are shaded in
blue and a sub techniques are showing the collapse view.
Now this is a similar view to the previous slide.
We just have selected the techniques and
sub-techniques for the group APT29 now.
The sub-techniques are also in
the now in the expanded view.
They have a little 3D depth to
make it a little more clear that they're there.
Once we have these two independent layers and navigator,
we can combine them to see which TTP's are
shared between the two different subgroups.
Here, we can see the overlapping techniques
between APT28 and APT29.
This is useful for our CTI analysis
because it allows you to prioritize
detections based on multiple groups
that are more likely to target your organization.
When you first open the ATT&CK navigator tool,
you're presented with a few options
for how you can get started.
You can either create a new layer by
selecting the appropriate domain for your CTI needs.
So that can be enterprise mobile or ICS
and you can also add a specific version as well.
The other options you have are to open
an existing layer from your system.
You can also create another layer from other layers
and you can also create a customized navigator layer.
To create a layer navigator,
you simply go to the browser version of Navigator
and you're already presented with
a window that has a new layer.
To add things to this layer,
you can click the "Select" tool and find
the pre-loaded threat groups from
the MITRE ATT&CK site where you can
simply select the group that you want to view in
the tool and it'll populate the associated techniques.
Here, we'll select APT28.
Once you've selected the group,
you can add a background color.
The button for that can be found under
the Technique Controls menu on the top right section.
Keep the technique selected with the color that you've
chosen here, which is in red.
Then you can also add a score
under the Technique Controls menu as well.
For this example, we'll enter a score of one to
indicate that the technique has been
used by this particular group.
Once those steps are complete,
we can rename the layer on the top-left tab to
make it easier for us to remember
which group we're tracking here.
Now that we finished APT28's layer,
we can then open a new tab within
navigator and create an additional layer.
We will find the techniques for the threat group, APT29.
Let's go ahead and do that now.
We'll go ahead and repeat the same exact process
that we did for APT28.
So go ahead and select the techniques for APT29,
give it a different background
color for those techniques.
This time, we'll select a different
scoring number to differentiate
between the two threat groups and their associated TTPs.
Here, we can just enter a score of two.
This is probably the most complex,
which is a little bit of an overstatement
feature of the navigator tool.
We're going to create a third layer by opening a new tab
and selecting the option create layer from other layers.
This will allow us to utilize the two layers that we just
made and create a single layer for our CTI analysis.
In order to compare
the techniques for these different layers,
we must enter a simple equation to express
the relationship between
these two layers that we just made.
We can simply type in a plus b to combine the scores.
You can see the labels for the layer at
the top-left tab section in case you need to reference.
We'll also want to edit the gradient where you can
set a low value of one and a high value,
which is the combined techniques
for these groups as three
to create a coloring for a combined heatmap layer.
When you're all finished with
scoring and comparing the layers,
you can then move on to determining what
you want to do with the analysis.
You have many options for exporting
your ATT&CK navigator layer.
The common uses for exporting or
saving the file as JSON or XML.
So you can reload it and reuse that layer in the future.
Also you can export the navigator layer as
an SVG image file where you'll
share the coverage heatmap with the rest of your team.
For the purposes of this training,
we'll go ahead and export it as an image file so you can
select the little camera icon
under the layer controls menu.
Before doing that, if you'd like to
expand the sub techniques to show deeper coverage,
you can go ahead and select that
from the layer control menus as
well. There you have it.
We now have our combined coverage map
for APT28 and APT29.
These are visualized here in
the SVG image export feature.
To summarize what we've learned here,
you should now be comfortable with
mapping different threat groups in
the ATT&CK navigator tool comparing their TTPs,
as well as exporting your combined layer
into a shareable image file.