MITRE mappings for recommendations

Author: memildin

articles/security-center/media/review-security-recommendations/recommendation-details-page.png

@@ -5,7 +5,7 @@ author: memildin
 manager: rkarlin
 ms.service: security-center
 ms.topic: reference
-ms.date: 11/04/2021
+ms.date: 11/07/2021
 ms.author: memildin
 ---
 # What's new in Microsoft Defender for Cloud?
@@ -32,6 +32,7 @@ Our Ignite release includes:
 - [Expanded security control assessments with Azure Security Benchmark v3](#expanded-security-control-assessments-with-azure-security-benchmark-v3)
 - [Microsoft Sentinel connector's optional bi-directional alert synchronization released for general availability (GA)](#microsoft-sentinel-connectors-optional-bi-directional-alert-synchronization-released-for-general-availability-ga)
 - [New recommendation to push Azure Kubernetes Service (AKS) logs to Sentinel](#new-recommendation-to-push-azure-kubernetes-service-aks-logs-to-sentinel)
+- [Recommendations mapped to the MITRE ATT&CK® framework - released for general availability (GA)](#recommendations-mapped-to-the-mitre-attck-framework---released-for-general-availability-ga)
 
 Other changes in November include:
 
@@ -117,6 +118,24 @@ The new recommendation, "Diagnostic logs in Kubernetes services should be enable
 We've also enhanced the "Auditing on SQL server should be enabled" recommendation with the same Sentinel streaming capabilities. 
 
 
+### Recommendations mapped to the MITRE ATT&CK® framework - released for general availability (GA)
+
+Wherever relevant, we're added references information to recommendations to show their position on the MITRE ATT&CK® framework. This globally accessible knowledge base of adversary tactics and techniques based on real-world observations, provides more context to help you understand the associated risks of a recommendation.  
+
+You'll find this information in the locations where recommendation information is used:
+
+- **Azure Resource Graph query results** for relevant recommendations include the MITRE ATT&CK® tactics and techniques.
+
+- **Recommendation details pages** show the mapping for all relevant recommendations:
+
+    :::image type="content" source="media/review-security-recommendations/tactics-window.png" alt-text="Screenshot of the MITRE tactics mapping for a recommendation.":::
+
+- **The recommendations page in Defender for Cloud** has a new :::image type="icon" source="media/review-security-recommendations/tactics-filter-recommendations-page.png" border="false"::: filter to select recommendations according to their associated tactic:
+
+
+
+Learn more in [Review your security recommendations](review-security-recommendations.md).
+
 ### Microsoft Threat and Vulnerability Management added as vulnerability assessment solution - released for general availability (GA)
 
 In October, [we announced](#microsoft-threat-and-vulnerability-management-added-as-vulnerability-assessment-solution-in-preview) an extension to the integration between [Microsoft Defender for servers](defender-for-servers-introduction.md) and Microsoft Defender for Endpoint, to support a new vulnerability assessment provider for your machines: [Microsoft threat and vulnerability management](/microsoft-365/security/defender-endpoint/next-gen-threat-and-vuln-mgt). This feature is now released for general availability (GA).

articles/security-center/media/review-security-recommendations/tactics-filter-recommendations-page.png

@@ -39,6 +39,10 @@ Defender for Cloud analyzes the security state of your resources to identify pot
     1. **Severity indicator**.
     1. **Freshness interval** (where relevant).
     1. **Count of exempted resources** if exemptions exist for this recommendation, this shows the number of resources that have been exempted.
+    1. **Mapping to MITRE ATT&CK ® tactics and techniques** if this recommendation has defined tactics and techniques, select the icon for links to the relevant pages on MITRE's site. 
+
+        :::image type="content" source="media/review-security-recommendations/tactics-window.png" alt-text="Screenshot of the MITRE tactics mapping for a recommendation.":::
+
     1. **Description** - A short description of the security issue.
     1. When relevant, the details page also includes a table of **related recommendations**: