A security team wants to map behaviors observed during a recent intrusion to a publicly maintained knowledge base organized as a matrix of adversary tactics and techniques, so it can identify detection gaps. Which reference source should the team use?

MITRE ATT&CK is a publicly available knowledge base of adversary tactics, which are the goals of an attacker such as initial access or persistence, and the techniques used to achieve them, based on real-world observations. It is organized as matrices of tactics and techniques, which lets defenders map observed behaviors to specific technique entries, compare them with existing detections, and identify where coverage is missing. That matches the team's goal exactly. The Cyber Kill Chain describes an intrusion as a sequence of high-level phases, from reconnaissance through actions on objectives; it is useful for understanding where an attack can be disrupted, but it does not catalog individual techniques in a matrix. The Diamond Model of Intrusion Analysis relates four core features of an event, namely adversary, capability, infrastructure, and victim, to support analysis and pivoting between related events; it is an analytic framework rather than a technique knowledge base. The Common Vulnerability Scoring System rates the severity of vulnerabilities; it describes weaknesses, not adversary behavior, and has no tactic or technique structure. Exam caveat: these models are complementary, and the same intrusion can be described with all three. Operational check: list each observed behavior with its ATT&CK technique identifier and mark whether an existing detection rule covers it.