Filtering the MITRE ATT&CK Dashboard

By default, the MITRE ATT&CK Dashboard shows you the most recent time each Job Action ran (Last Run) for all security zones (All Selected). However, you can configure both the time range and zones used. You can filter based on a time until the present (Relative) or set a custom time range (Absolute). You can also filter to only show specific zones, instead of all zones.

If you want to view information for all Tactics, Techniques, and Sub-Techniques, click Expand All. This lets you see the security technologies identified during the Job Actions for each Tactic as well as all Techniques, Sub-Techniques and their percentage blocked or not blocked.

Filter options you set on the MITRE dashboard apply to the filtered Jobs list that comes up when you click on View Details for one of the Techniques or Sub-Techniques. This lets you include more or less data, depending on how you update the filter.

To set a filter for the MITRE ATT&CK Dashboard

If you configure your filter, this new configuration becomes the default dashboard view when you use the same browser. To return to the default filter, choose Last Run for View Mode and select all security zones for Zones.

Select Analyze > MITRE ATT&CK Dashboard.
Configure the View Mode.
1. Choose your View Mode (Last Run or Time Range).
  If you choose Last Run, you can ignore the remaining sub-steps and go to Step 3.
  
  If you choose a Time Range, you will be able to see all Job Action results from that range when you view a Technique or Sub-Technique's details.
2. Click your time period option, then configure your relative or absolute time range.
3. Click Apply.
Configure the Filter Rules.
1. Click the existing Filter Rules selection.
2. Click Add Rule.
3. Select an attribute to match against.
  
  Available attribute options relate to Action details, Job Action results, and Actors.
4. Select an additional attribute trait to match against. This varies depending on the Job Action attribute you select. See Data Source/Filter Rule Values in Job Reports and the MITRE ATT&CK Dashboard for the full list of options.
5. (Optional) Select either AND to add another condition to the rule or OR (Add Rule) to add another rule.
6. (Optional) Select the vertical ellipses () next to a rule to clone or delete it.
7. Click Apply.
When you apply Filter Rules, results in the dashboard will include all Actions that match those rules.

MITRE ATT&CK Dashboard filter with an absolute time range and three security zones selected