MITRE ATT&CK: adversary behavior knowledge base (not coverage, not compliance)

What category of knowledge base this is

MITRE ATT&CK is a knowledge base of adversarial techniques based on real-world observations. The Get Started page says it focuses on how adversaries interact with systems during an operation. Tactics are why an adversary performs an action. Techniques are how adversaries achieve those tactical goals. It is a language for behaviors and evidence. It is not a scoring system that proves defensive coverage.

Who it commonly frames: detection engineers and SOC learners who tag a case once evidence exists, threat intelligence readers who need a shared behavior name, and AppSec readers who meet technique names on vendor slides. Foundations readers may have seen ATT&CK only as a name on the six-map comparison. This is an industry knowledge base. It is not a U.S. statute, and it is not a certification scheme.

What security people most often confuse: they fold a green matrix cell, a compliance badge, a finished CSF profile, a product that "has ATT&CK," and an Atlas lesson into one seal. This page keeps those objects apart. The Reference card at /reference/frameworks/mitre-attack-v19-2/ remains the framework summary. This explainer complements that card. It does not replace it, and it does not list tactics or techniques.

Name a behavior only when evidence supports it

Pick one real or synthetic case. Map only techniques supported by evidence. Leave the rest unmarked. Ask what telemetry would show this technique, rather than what share of a matrix looks green.

Riverstone can tag the Jordan Hale case with relevant techniques once evidence exists, without coloring a matrix cell and declaring victory. The triage note on /learn/topics/identity-alert-triage/ and the investigation timeline on /learn/topics/investigate-respond-verify/ stay that evidence habit. This page does not rewrite those lessons into an ATT&CK course. The Agentic SOC lesson (/learn/topics/agentic-soc/) already records a coverage limit when a connector is missing. That sentence is about missing evidence. It is not an ATT&CK coverage score.

MITRE's Get Started page says not to treat a checklist as done, not to try to achieve complete coverage, and not to color a box green because one way of performing a technique was seen. Adversaries have more than one way to perform most techniques. Not every tactic or technique applies to every organization. Do not invent a coverage percentage for a board.

A matrix cell is a label

A matrix cell is a label for a behavior class. Painting it green does not mean a TrackPort export would be caught. One detection does not paint a technique green forever. The same Get Started page says the matrix documents observed real-world behaviors, and that adversaries may use behaviors the matrix does not document yet.

ATT&CK Navigator can visualize defensive coverage, planning, and detected techniques. A heatmap is not the lesson on this page, and paint is not evidence. This page does not ship a second matrix, and it does not assign colors. It is not a Navigator heatmap tutorial.

What this card is not

Not a tactic or technique encyclopedia. Not a Navigator heatmap tutorial as the lesson core. Not a replacement for the Reference framework card at /reference/frameworks/mitre-attack-v19-2/. Not red-team exploit homework. Not proof that attackers will skip you. Not a SOC playbook dump. Not an Atlas attestation of coverage.

Not a CSF 2.0 profile. CSF 2.0 is outcomes and function language. ATT&CK is adversary-behavior description. Related maps may exist. Do not collapse them. Outcomes live on /learn/topics/outcomes-then-controls/ and on /reference/frameworks/nist-csf-2-0/. The six-map comparison is /reference/frameworks/compare/. The ATT&CK row there says the purpose is to describe adversary behaviors, that the map is not certifiable, and that a typical misuse is treating a coverage percentage as a compliance score. A row is not this page, and a row is not a heatmap.

Rewrite the one-line claim

Replace "we are ATT&CK, covered, CSF, and product-badge secure" with a reading sentence. We use ATT&CK v19.2 as a behavior-naming and evidence-hunting knowledge base. That is different from CSF 2.0 outcomes, from a compliance attestation, and from product marketing that says a tool has ATT&CK.

When a slide shows a green heatmap, privately ask which behaviors have evidence and which telemetry would show them, before treating paint as coverage. Do not paste proprietary detection logic, or customer data, into Atlas.

A matrix cell is not coverage, not compliance, not a CSF profile, not a product badge, and not an Atlas seal

Teaching table only. It does not assign coverage, a certificate, a CSF profile, a product finding, or a detection seal. It does not invent a coverage percentage.

Glossary and nearby pages

• Evidence
• Alert
• Log
• SOC
• Control

• MITRE ATT&CK Reference card (framework summary, not replaced by this page)
• Compare the six maps (a row is not a heatmap)
• Triage a synthetic identity alert (S1, evidence habit)
• Investigate, respond, and verify recovery (S3)
• Understand and build toward an Agentic SOC (S4)
• Outcomes first, then controls (F8a)
• NIST CSF 2.0 framework card (outcomes, not a behavior matrix)
• SOC analyst practice path
• Privacy is not a CIA checkbox