Merge pull request #50585 from KenMAG/main

Updated the MITRE ATT&CK module for Sentinel in Defender and Azure

Author: JillGrant615

learn-pr/wwl-sci/what-is-threat-hunting-azure-sentinel/3a-explore-mitre-att-ck.yml

@@ -4,8 +4,8 @@ title: Explore MITRE ATT&CK
 metadata:
   title: Explore MITRE ATT&CK
   description: "Explore MITRE ATT&CK"
-  ms.date: 06/29/2022
-  author: wwlpublish
+  ms.date: 05/21/2025
+  author: KenMAG
   ms.author: kelawson
   ms.topic: unit
 azureSandbox: false

learn-pr/wwl-sci/what-is-threat-hunting-azure-sentinel/includes/3a-explore-mitre-att-ck.md

@@ -1,66 +1,93 @@
-MITRE ATT&CK is a publicly accessible knowledge base of tactics and techniques that are commonly used by attackers, and is created and maintained by observing real-world observations. Many organizations use the MITRE ATT&CK knowledge base to develop specific threat models and methodologies that are used to verify security status in their environments.
+MITRE ATT&CK is a publicly accessible knowledge base of tactics, techniques, and procedures (TTP) that are commonly used by attackers, and is created and maintained by observing real-world observations. Many organizations use the MITRE ATT&CK knowledge base to develop specific threat models and methodologies that are used to verify security status in their environments.
 
 Microsoft Sentinel analyzes ingested data, not only to detect threats and help you investigate, but also to visualize the nature and coverage of your organization's security status.
 
-
-When developing a threat hunting hypothesis, it's critical to understand tactics and techniques you're searching for. The MITRE ATT&CK framework is used throughout Microsoft Sentinel.
-
+When developing a threat hunting hypothesis, it's critical to understand the tactics (why), techniques (how), and procedures (implementations) you're searching for. The MITRE ATT&CK framework is used throughout Microsoft Sentinel.
 
 Use the MITRE ATT&CK selection under Threat Management in Microsoft Sentinel to view the detections already active in your workspace, and those available for you to configure, to understand your organization's security coverage, based on the tactics and techniques from the MITRE ATT&CK® framework.
 
-
 ## View current MITRE coverage
-In Microsoft Sentinel, in the Threat management menu on the left, select MITRE. By default, both currently active scheduled query and near real-time (NRT) rules are indicated in the coverage matrix.
+
+## [Defender portal](#tab/defender-portal)
+
+In Microsoft Sentinel, in the [Defender portal](https://security.microsoft.com/), select the *Threat management* section of the navigation menu, select MITRE ATT&CK. By default, Active scheduled query, Active near real-time (NRT) rules, and Active anomaly query rules are indicated in the coverage matrix.
 
 - **Use the legend at the top-right** to understand how many detections are currently active in your workspace for specific technique.
 
-- **Use the search bar at the top-left** to search for a specific technique in the matrix, using the technique name or ID, to view your organization's security status for the selected technique.
+- **Use the search bar** at the top right to search for a specific technique in the matrix, using the technique name or ID, to view your organization's security status for the selected technique.
 
-- **Select a specific technique** in the matrix to view more details on the right. There, use the links to jump to any of the following locations:
+- **Select a specific technique** in the top row of the matrix to view in the details pane on the right. There, use the links to jump to any of the following locations:
 
-    - Select View technique details for more information about the selected technique in the MITRE ATT&CK framework knowledge base.
+  - Select *View full tactic or technique details* links for more information in the MITRE ATT&CK framework knowledge base.
 
-    - Select links to any of the active items to jump to the relevant area in Microsoft Sentinel.
+  - Select links to any of the *Active coverage* rules to jump to the relevant area in Microsoft Sentinel.
+  
+- **View MITRE by threat scenarios** to view the coverage matrix by threat scenarios:
 
-## Simulate possible coverage with available detections
+  - Drag the **View MITRE by threat scenarios** slider to the right to view the coverage matrix by threat scenarios. The matrix is filtered to show only the techniques that are relevant to the selected scenario.
 
-In the MITRE coverage matrix, simulated coverage refers to detections that are available, but not currently configured, in your Microsoft Sentinel workspace. View your simulated coverage to understand your organization's possible security status, were you to configure all detections available to you.
+    :::image type="content" source="../media/mitre-threat-hunting-scenario.png" alt-text="Screenshot of the MITRE ATT&CK threat scenarios drop down menu." lightbox="../media/mitre-threat-hunting-scenario.png":::
+
+## Simulate possible rules coverage
+
+In the MITRE matrix, simulated coverage refers to detections that are available, but not currently configured, in your Microsoft Sentinel workspace. View your simulated coverage to understand your organization's possible security status, were you to configure all detections available to you.
+
+> [!IMPORTANT]
+> If you have the *View MITRE by threat scenarios* slider enabled, and have selected a scenario, the Simulated rules (Product simulation) will be disabled.
+
+- From the Microsoft Defender navigation menu, expand the Microsoft Sentinel section, and select *Threat management*, then select MITRE ATT&CK.
+
+- Select items in the Simulated rules drop-down menu to simulate your organization's possible security status.
 
-In Microsoft Sentinel, in the General menu on the left, select MITRE.
+- For example, select **Hunting queries**, and then select *Hunting queries* **View** link to jump to the Microsoft Sentinel Hunting page. There, you see a filtered list of the hunting queries that are associated with the selected technique, and available for you to configure in your workspace.
 
-Select items in the Simulate menu to simulate your organization's possible security status.
+## [Azure portal](#tab/azure-portal)
 
-- **Use the legend at the top-right** to understand how many detections, including analytics rule templates or hunting queries, are available for you to configure.
+In Microsoft Sentinel, in the [Azure portal](https://portal.azure.com/), select the *Threat management* section of the navigation menu, then select **MITRE ATT&CK (Preview)**. By default, Active scheduled query, Active near real-time (NRT) rules, and Active anomaly query rules are indicated in the coverage matrix.
 
-- **Use the search bar at the top-left** to search for a specific technique in the matrix, using the technique name or ID, to view your organization's simulated security status for the selected technique.
+- **Use the legend at the top-right** to understand how many detections are currently active in your workspace for specific technique.
+
+- **Use the search bar** At the top-left to search for a specific technique in the matrix, using the technique name or ID, to view your organization's security status for the selected technique.
 
 - **Select a specific technique** in the matrix to view more details on the right. There, use the links to jump to any of the following locations:
 
-    - Select View technique details for more information about the selected technique in the MITRE ATT&CK framework knowledge base.
+  - Select *View full tactic or technique details* links for more information in the MITRE ATT&CK framework knowledge base.
+
+  - Select links to any of the *Active coverage* rules to jump to the relevant area in Microsoft Sentinel.
+
+## Simulate rule detections
+
+In the MITRE coverage matrix, simulated coverage refers to detections that are available, but not currently configured, in your Microsoft Sentinel workspace. View your simulated coverage to understand your organization's possible security status, were you to configure all detections available to you.
+
+- In Microsoft Sentinel, select the *Threat management* section of the navigation menu, select MITRE ATT&CK.
+
+- Select items in the Simulated rules drop-down menu to simulate your organization's possible security status.
+
+- For example, select **Hunting queries**, and then select *Hunting queries* **View** link to jump to the Microsoft Sentinel Hunting page. There, you see a filtered list of the hunting queries that are associated with the selected technique, and available for you to configure in your workspace.
 
-    - Select links to any of the simulation items to jump to the relevant area in Microsoft Sentinel.
+    :::image type="content" source="../media/mitre-simulated-rules.png" alt-text="Screenshot of the MITRE ATT&CK simulated rule coverage." lightbox="../media/mitre-simulated-rules.png":::
 
-For example, select Hunting queries to jump to the Hunting page. There, you'll see a filtered list of the hunting queries that are associated with the selected technique, and available for you to configure in your workspace.
+---
 
 ## Use the MITRE ATT&CK framework in analytics rules and incidents
 
-Having a scheduled rule with MITRE techniques applied running regularly in your Microsoft Sentinel workspace enhances the security status shown for your organization in the MITRE coverage matrix.
+Having a scheduled analytical rule with MITRE techniques applied running regularly in your Microsoft Sentinel workspace enhances the security status shown for your organization in the MITRE coverage matrix.
 
 - **Analytics rules:**
 
-    - When configuring analytics rules, select specific MITRE techniques to apply to your rule.
-    - When searching for analytics rules, filter the rules displayed by technique to find your rules quicker.
-
+  - When configuring analytics rules, select specific MITRE techniques to apply to your rule.
+  - When searching for analytics rules, filter the rules displayed by technique to find your rules quicker.
+  
+    image type="content" source="../media/mitre-analytic-rule-technique.png" alt-text="Screenshot of the MITRE ATT&CK analytics rules configuration." lightbox="../media/mitre-analytic-rule-technique.png":::
+  
 - **Incidents:**
 
 When incidents are created for alerts that are surfaced by rules with MITRE techniques configured, the techniques are also added to the incidents.
 
-
 - **Threat hunting:**
 
-    - When creating a new hunting query, select the specific tactics and techniques to apply to your query.
-
-    - When searching for active hunting queries, filter the queries displayed by tactics by selecting an item from the list above the grid. Select a query to see tactic and technique details on the right.
+  - When creating a new hunting query, select the specific tactics and techniques to apply to your query.
 
-    - When creating bookmarks, either use the technique mapping inherited from the hunting query, or create your own mapping.
+  - When searching for active hunting queries, filter the queries displayed by tactics by selecting an item from the list above the grid. Select a query to see tactic and technique details on the right.
 
+  - When creating bookmarks, either use the technique mapping inherited from the hunting query, or create your own mapping.

learn-pr/wwl-sci/what-is-threat-hunting-azure-sentinel/index.yml

@@ -3,15 +3,15 @@ uid: learn.wwl.what-is-threat-hunting-azure-sentinel
 metadata:
   title: Explain threat hunting concepts in Microsoft Sentinel
   description: "Explain threat hunting concepts in Microsoft Sentinel"
-  ms.date: 06/29/2022
-  author: wwlpublish
+  ms.date: 05/21/2025
+  author: KenMAG
   ms.author: kelawson
   ms.topic: module
   ms.service: microsoft-sentinel
 title: Explain threat hunting concepts in Microsoft Sentinel
 summary: Learn the threat hunting process in Microsoft Sentinel.
 abstract: |
-  Upon completion of this module, the learner will be able to:
+  Upon completion of this module, the learner is able to:
   - Describe threat hunting concepts for use with Microsoft Sentinel
   - Define a threat hunting hypothesis for use in Microsoft Sentinel
 prerequisites: |
@@ -23,6 +23,7 @@ roles:
 - security-operations-analyst
 products:
 - azure
+- defender-xdr
 - microsoft-sentinel
 subjects:
 - security