> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cymph.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage presets

Presets allow you to customise frameworks to your organisational environment and requirements. In this guide, we are going to show you how to create and manage a preset based on the MITRE ATT\&CK for Enterprise framework. A similar process is followed for other frameworks.

# How to create a preset

1. Go to the **Mindmaps** section
   * Click on Mind maps from the navigation menu
2. Create a preset
   * Click on **Create Preset** quick action from the navigation sidebar
   * The preset creation wizard will start

<img src="https://mintcdn.com/cymph/3HkhY2GCsxl__NB1/images/createpreset1.png?fit=max&auto=format&n=3HkhY2GCsxl__NB1&q=85&s=0ea237daaf84b4746ed687a4b2b2b695" alt="Createpreset1" width="3456" height="1684" data-path="images/createpreset1.png" />

## Step 1: Choose a framework

Select a framework of interest. Currently, we support MITRE ATT\&CK for Enterprise, MITRE D3FEND, MITRE ATLAS and ISO27001.

<img src="https://mintcdn.com/cymph/QaJcLk5m_QOR38qC/images/selectframework.png?fit=max&auto=format&n=QaJcLk5m_QOR38qC&q=85&s=8da4760e86fad3b8a3696f9a4bd98a59" alt="Selectframework" width="3456" height="1710" data-path="images/selectframework.png" />

## Step 2: Select the scope source

There are three available options :

1. Select the framework elements manually
2. Import from a MITRE ATT\&CK Navigator layer (only when MITRE ATT\&CK framework is selected at step 1)
3. Import tags from an existing detection system (only when MITRE ATT\&CK framework is selected at step 1). If you select that step, you will also need to select an integration. Currently, Wazuh and Microsoft Sentinel are supported.

<Frame>
  <img src="https://mintcdn.com/cymph/E8AYaPCFa9dvN8Nd/images/preset_scope_source.png?fit=max&auto=format&n=E8AYaPCFa9dvN8Nd&q=85&s=599ba2618c352c40ce6755d8574f0a51" alt="Preset Scope Source" width="3456" height="1722" data-path="images/preset_scope_source.png" />
</Frame>

## Step 3: Select the relevant elements of the framework for your preset

You can select individual techniques or entire tactics that are relevant to you. If on step 2, you selected a detection-based scope (dynamic sync)

<img src="https://mintcdn.com/cymph/3HkhY2GCsxl__NB1/images/definescope.png?fit=max&auto=format&n=3HkhY2GCsxl__NB1&q=85&s=70deb75ea9ede2e04aeadd99a02ed19a" alt="Definescope" width="3456" height="1722" data-path="images/definescope.png" />

You can even select individual sub-techniques. You can expand and collapse a technique to show/hide the associated sub-techniques.

<img src="https://mintcdn.com/cymph/3HkhY2GCsxl__NB1/images/expand_collapse_techniques.gif?s=fc8c12dcafcea9dc70a625cdd8550b84" alt="Expand Collapse Techniques" width="1268" height="633" data-path="images/expand_collapse_techniques.gif" />

Specifically for MITRE ATT\&CK for Enterprise, you can filter the view by product. For example, by selecting Windows only the techniques associated with the Windows platform will be displayed so you can easily select all of them by clicking on the **Select all displayed techniques.**

<img src="https://mintcdn.com/cymph/QaJcLk5m_QOR38qC/images/select_windows.gif?s=6293f6a345b3ebc8e9c559a7ac75b52b" alt="Select Windows" width="1337" height="667" data-path="images/select_windows.gif" />

<Tip>
  You can expand and collapse all techniques by clicking Expand all/Hide all from the top right corner of the matrix
</Tip>

## Step 4: Configure the preset settings

Once you have selected the relevant techniques/sub-techniques, you need to provide additional information about the preset:

* Preset name (required): a name to identify this preset.
* Description (optional)
* The playbooks that will be used to calculate the coverage of the preset. The available options are:
  * Created by me: only the playbooks created by you will be used
  * Shared with me: only the playbooks that are shared with you will be used
  * Public playbooks: only publicly shared playbooks will be used
  * A filter that was saved from the playbook management system. See  Filter playbooks for more details
* Share preset: enable it if you want to share this preset with your organisation
* Use automatic framework mappings when manual mappings are not set: enable this if you want to use the AI-suggested mappings of the playbooks in case you have not manually mapped your playbooks

<img src="https://mintcdn.com/cymph/QaJcLk5m_QOR38qC/images/preset_config.png?fit=max&auto=format&n=QaJcLk5m_QOR38qC&q=85&s=8c4922feae83c22136cfccb2beea0fdc" alt="Preset Config" width="3452" height="1722" data-path="images/preset_config.png" />

## Step 5: Set coverage criteria

In order for a playbook that is mapped to a technique/sub-technique to be considered that it covers that technique/sub-technique, we should define the criteria when evaluating it. Currently, we support two different criteria:

1. **Playbooks exists in your workspace**: no additional properties need to be met, the sole existence of the playbook is enough.
2. **Playbook matches selected status**: the playbook must have a certain status in order to be considered. The available statuses are Planned, In progress, In review and Completed.

<img src="https://mintcdn.com/cymph/QaJcLk5m_QOR38qC/images/preset_coverage.png?fit=max&auto=format&n=QaJcLk5m_QOR38qC&q=85&s=8c3994fcfd93fcb734f90f2e93cc722b" alt="Preset Coverage" width="3456" height="1710" data-path="images/preset_coverage.png" />

Click on **Save Preset** and your preset is ready!

# How to edit a preset

1. Go to the page of the preset
   * Select **Mind maps** from the navigations menu, and then select your preset from the \*\*My Presets \*\*dropdown menu

<img src="https://mintcdn.com/cymph/UH9o9k6jbiOJe8Rw/images/presetnav.png?fit=max&auto=format&n=UH9o9k6jbiOJe8Rw&q=85&s=7357d80a3d3c553391cf6b11dda8a3c3" alt="Presetnav" width="3456" height="1694" data-path="images/presetnav.png" />

2. Open the action menu of the preset
   * Click on the triple dot action button next to the preset name

<img src="https://mintcdn.com/cymph/UH9o9k6jbiOJe8Rw/images/preset_action.png?fit=max&auto=format&n=UH9o9k6jbiOJe8Rw&q=85&s=a64a6fb3705d3aafb4898ab92b016b28" alt="Preset Action" width="3456" height="1690" data-path="images/preset_action.png" />

3. Edit your preset
   * Select the **Edit Preset** option

<img src="https://mintcdn.com/cymph/5Zmyin5iSA8coUZN/images/edit_preset.png?fit=max&auto=format&n=5Zmyin5iSA8coUZN&q=85&s=c6df07e1ef07f225889024300c548c28" alt="Edit Preset" width="3456" height="1692" data-path="images/edit_preset.png" />

4. The edit process follows the same steps as the preset creation. At each individual step modify the information you want.

# How to delete a preset

1. Go to the page of the preset
   * Select **Mind maps** from the navigations menu, and then select your preset from the **My Presets** dropdown menu
2. Open the action menu of the preset
   * Click on the triple dot action button next to the preset name
3. Delete your preset
   * Select **Remove Prese**t from the dropdown menu
   * Confirm that you want to remove the preset

# How to duplicate a preset

1. Go to the page of the preset
   * Select **Mind maps** from the navigations menu, and then select your preset from the **My Presets** dropdown menu
2. Open the action menu of the preset
   * Click on the triple dot action button next to the preset name
3. Duplicate your preset
   * Select **Duplicate Preset** from the dropdown menu

A copy of your preset will be created with the suffix "(copy)" appended to the original name.

# How to share and unshare a preset with your organisation

1. Go to the page of the preset
   * Select **Mind maps** from the navigations menu, and then select your preset from the **My Presets** dropdown menu
2. Open the action menu of the preset
   * Click on the triple dot action button next to the preset name
3. Share or unshare your preset
   * Select **Share Preset** from the dropdown menu if the preset is not already shared
   * Select **Unshare Preset** if the preset is already shared and you want to unshare it
