Presets allow you to customise frameworks to your organisational environment and requirements. In this guide, we are going to show you how to create and manage a preset based on the MITRE ATT&CK for Enterprise framework. A similar process is followed for other frameworks.

How to create a preset

Go to the Mindmaps section
- Click on Mind maps from the navigation menu
Create a preset
- Click on Create Preset quick action from the navigation sidebar
- The preset creation wizard will start

Step 1: Select a preset base

You can choose to start from either scenarios (for example Phishing, Ransomware etc). or from specific frameworks. If you select to start from scenarios, you will go immediately to step 2.

Step 1b: Choose a framework

If your preset base is a specific framework, the next step is to select the framework of interest. Currently, we support MITRE ATT&CK for Enterprise, MITRE D3FEND, MITRE ATLAS, NIST CSF 2.0, ISO27001, ISO27002:2022, NIS2, GDPR and DORA. Frameworks are versioned so at this step you are also able to select the desired version.

Step 2: Select the scope source

There are four available options :

Select the framework elements manually
Import from a MITRE ATT&CK Navigator layer (only when MITRE ATT&CK for Enterprise or MITRE ATT&CK for ICS framework is selected at step 1)
Import from SIGMA rules (only when MITRE ATT&CK framework for Enterprise is selected at step 1)
Import tags from an existing detection system (only when MITRE ATT&CK framework for Enterprise is selected at step 1). If you select that step, you will also need to select an integration. Currently, Wazuh, Microsoft Sentinel, Splunk Enterprise Security and Cortex XSIAM are supported.

Importing a MITRE ATT&CK Navigator Layer

In the first step, you will need to select the files that need to be imported. At this step, you can also control the behavior of tactics expansion. By default, if a tactic ID is seen in the data, it will not be expanded to all its techniques. At this step you can also quickly change the framework version, if you suspect or verify a version mismatch. A second switch, Ignore techniques not found in the framework, controls what happens to a technique ID that the selected framework version does not know. It is off by default, so such an ID blocks the import; switched on, the ID is skipped and the rest of the file is imported. See Technique IDs that are not part of the framework below.

Once you click Validate, you will be redirected to the validation result page. You will be able to see potential errors with the data such as:

Wrong layer format
No tags in the data
Tags found in the data are not part of the framework
The layer belongs to a different domain (e.g. you imported a Navigator layer for ICS but the selected framework was Enterprise)

Importing SIGMA rules

The process is the same as importing Navigator layers. For Sigma rules, the tags are extracted from the tags attribute and the format is expected to be attack.<technique ID>. Tactic tags are ignored during processing. For example:

tags:
    - attack.credential_access
    - attack.t1558.003

Configure live source

In the first step, you will need to select the integrations to be used. The following integrations are supported:

Microsoft Sentinel
Wazuh
Splunk Enterprise Security
Cortex XSIAM

At this step, you can also control the behavior of tactics expansion. By default, if a tactic ID is seen in the data, it will not be expanded to all its techniques. At this step you can also quickly change the framework version, if you suspect or verify a version mismatch. The Ignore techniques not found in the framework switch sits next to the tactic-expansion switch. Leave it off to have any unknown technique ID block the import; switch it on to skip such IDs and import everything else the sources return. For a live source the choice is saved with the preset, so the scope keeps resolving on every refresh.

Once you select one or more integrations, click Continue. You will then be redirected to a summary of the results. When multiple integrations are selected, Cymph combines the valid MITRE ATT&CK identifiers returned by the selected sources. Duplicate identifiers are included only once in the resulting scope. Per-source errors will be reported. If there is at least 1 tag and no errors are found, you will be able to proceed to the next step. Tags that are not valid for the selected framework version are surfaced as validation issues and are never silently imported or remapped. Each issue names the detection rules the ID was found in and what to do about it. If a version mismatch is detected, you can return to the previous step and select the appropriate framework version; if the IDs are simply stale, go back and switch on Ignore techniques not found in the framework. Detection-based scopes use event-driven synchronization. Cymph refreshes the scope from the configured detection sources when the preset is accessed through the UI or API. Presets that use live detection sources do not rely on a scheduled background refresh. The Define Scope step shows which integrations the scope comes from and whether unknown techniques are being ignored.

Technique IDs that are not part of the framework

Detection content is often written against an older ATT&CK release than the one the preset uses, and single rules can carry typos. Whatever the source, an ID that the selected framework version does not know is reported in the import summary as an issue with:

the ID and the message technique ID … is not part of the framework
the rules it was found in — the Splunk correlation search, Wazuh rule, Sentinel analytics rule, Elastic rule, Cortex XSIAM correlation rule or Sigma rule title, so you can locate it in the source
a remediation — when the ID exists in another framework version that Cymph ships, the versions are listed and switching the preset to one of them is suggested; when it exists in none, it was most likely revoked or deprecated by MITRE, or comes from a typo or a misconfigured mapping in the rule

A banner above the issue list summarises the situation and offers a shortcut back to the previous step to change the version or switch on the ignore option. With Ignore techniques not found in the framework switched on, the same IDs are listed as skipped instead of blocking the import. Only the unknown ID is dropped: a rule carrying one stale ID and three valid ones still contributes the three. Skipped IDs remain visible in the summary so that a genuine mistake is not hidden.

Vendor-shipped content, such as the Splunk Enterprise Security apps and ESCU, is known to carry a few revoked ATT&CK IDs that no supported framework version contains. Since that content is overwritten on every update, the ignore switch is the recommended way to import it. See Splunk Enterprise Security.

Step 3: Select the relevant elements of the framework for your preset

You can select individual techniques or entire tactics that are relevant to you. If on step 2, you selected a detection-based scope (live source)

You can even select individual sub-techniques. You can expand and collapse a technique to show/hide the associated sub-techniques.

Specifically for MITRE ATT&CK for Enterprise, you can filter the view by product. For example, by selecting Windows only the techniques associated with the Windows platform will be displayed so you can easily select all of them by clicking on the Select all displayed techniques.

You can expand and collapse all techniques by clicking Expand all/Hide all from the top right corner of the matrix

Step 4: Configure the preset settings

Once you have selected the relevant techniques/sub-techniques, you need to provide additional information about the preset:

Preset name (required): a name to identify this preset.
Description (optional)
The playbooks that will be used to calculate the coverage of the preset. The available options are:
- Created by me: only the playbooks created by you will be used
- Shared with me: only the playbooks that are shared with you will be used
- Public playbooks: only publicly shared playbooks will be used
- A filter that was saved from the playbook management system. See Filter playbooks for more details
Share preset: enable it if you want to share this preset with your organisation
Use automatic framework mappings when manual mappings are not set: enable this if you want to use the AI-suggested mappings of the playbooks in case you have not manually mapped your playbooks

Step 5: Set coverage criteria

In order for a playbook that is mapped to a technique/sub-technique to be considered that it covers that technique/sub-technique, we should define the criteria when evaluating it. Currently, we support two different criteria:

Playbooks exists in your workspace: no additional properties need to be met, the sole existence of the playbook is enough.
Playbook matches selected status: the playbook must have a certain status in order to be considered. The available statuses are Planned, In progress, In review and Completed.

Click on Save Preset and your preset is ready!

How to edit a preset

Go to the page of the preset
- Select Mind maps from the navigations menu, and then select your preset from the My Presets dropdown menu

Open the action menu of the preset
- Click on the triple dot action button next to the preset name

Edit your preset
- Select the Edit Preset option

The edit process follows the same steps as the preset creation. At each individual step modify the information you want.

How to delete a preset

Go to the page of the preset
- Select Mind maps from the navigations menu, and then select your preset from the My Presets dropdown menu
Open the action menu of the preset
- Click on the triple dot action button next to the preset name
Delete your preset
- Select Remove Preset from the dropdown menu
- Confirm that you want to remove the preset

How to duplicate a preset

Go to the page of the preset
- Select Mind maps from the navigations menu, and then select your preset from the My Presets dropdown menu
Open the action menu of the preset
- Click on the triple dot action button next to the preset name
Duplicate your preset
- Select Duplicate Preset from the dropdown menu

A copy of your preset will be created with the suffix “(copy)” appended to the original name.

Getting started

Use cases

Key features explained

How-to's

Integrations

Synchronization

Settings

Administration

Deployment

Security & governance

Troubleshooting

Manage presets

How to create a preset

Step 1: Select a preset base

Step 1b: Choose a framework