// tool reference · Monitoring & Detection
MITRE ATT&CK Mapper Free
Map an observation to ATT&CK tactics and techniques.
What it does
Translates "what I saw" into ATT&CK tactics and techniques, so your write-up uses the vocabulary everyone else does.
When to use it
- Writing an incident report; building detection coverage maps.
Inputs
Field names are the actual form parameters, verified against source.
| Field | Type | Required | Notes |
|---|---|---|---|
| observation | textarea | required | What you observed, in plain language. |
What you get back
Candidate techniques with tactic and rationale.
Worked example
Input
A service account logged in interactively at 3am from a new IP, then ran whoami and net group "domain admins"
Output (abridged)
MAPPED -- 3 techniques, 1 likely chain
T1078.002 Valid Accounts: Domain Accounts (Initial Access)
Service account + interactive login = misuse of a legitimate
credential. Service accounts should never log in interactively.
T1033 System Owner/User Discovery (Discovery)
'whoami' -- orienting after landing.
T1069.002 Permission Groups Discovery: Domain (Discovery)
'net group "domain admins"' -- mapping the path to privilege.
CHAIN: valid credential -> orient -> enumerate privilege targets.
That is the opening of a hands-on-keyboard intrusion, not a script.
NEXT: T1021 Lateral Movement is the likely follow-on. Look there now.
How it works
Deterministic mapping against the ATT&CK matrix.
Limits
Read live from the platform configuration.
| Rate limit | 30 requests / 60s (platform default) |
Limitations — what it does not do
It maps a description to the matrix. Mapping quality depends on your description, and several techniques often fit one observation -- treat candidates as hypotheses.
Privacy
Nothing is stored.
Standards
MITRE ATT&CK
Related tools
AI Detection-Engineering Studio
Turn a threat description or log sample into a Sigma detection rule, a SIEM query, false-positive tuning, and test cases.
AI Incident Report Writer
Turn incident facts and findings into a structured report — summary, timeline, impact, MITRE mapping, remediation.
Log Analyzer
Paste logs to detect brute-force, privilege escalation and malware indicators with MITRE mapping.