Skip to content

How to Add a Tactics, Techniques and Procedures Catalog#

This topic provides step-by-step instructions for adding a Tactics, Techniques and Procedures (TTPs) catalog in TheHive.

TTPs describe the behaviors and methods commonly used by specific threat actors or groups.

Use this procedure to add more MITRE catalogs than the default one included in TheHive.

Required permissions

Only users with an admin-type profile that has the managePattern permission can manage TTPs in TheHive.

Procedure

  1. Go to the Entities management view from the sidebar menu.

    Entities management

  2. Select the Attack patterns tab.

    Attack patterns tab

  3. Select Import MITRE ATT&CK patterns.

  4. In the Import MITRE ATT&CK patterns drawer, enter a unique name for the catalog. You can’t use a name that’s already taken.

  5. Drop a JSON file.

  6. Select Import.

    Hang tight

    It may take a few seconds to add a TTPs catalog.

Next steps