Cross-domain learning module · not a twelfth domain

MITRE ATT&CK Knowledge Mesh

Move from adversary behavior to explanation, evidence, detection, mitigation, and practice. Every technique is connected to official ATT&CK 19.1 data and contextually relevant Cyber Knowledge modules.

Interpretation boundary: a link means “useful learning context.” It does not prove actor use, compromise, control coverage, or detection effectiveness.

Loading ATT&CK mesh…

Search techniques, IDs, groups, mitigations, and defenses Platform

Enterprise ATT&CK matrix

Choose a technique to inspect source-backed detail and learning routes. Parent techniques can be expanded to reveal sub-techniques.

Mapping method and confidence

The mesh combines four explicitly labelled routes: a technique ID written in a module, an exact technique-name match, a governed topic match, or a conservative tactic-level route. Mappings are built deterministically from the deployed Cyber Knowledge HTML and the official MITRE ATT&CK STIX 2.1 bundle.

Explicit ID: strongest route; the module contains the ATT&CK identifier.
Explicit name: the full MITRE technique name appears in the module.
Topic match: technique vocabulary, tactic, and controlled domain vocabulary overlap.
Tactic route: broad fallback to a practitioner module that explains the relevant operational phase.

All ATT&CK descriptions, group relationships, mitigations, detection strategies, and analytics remain attributed to MITRE. Cyber Knowledge links provide editorial context authored for 1200km.