A city CISO asks how Enterprise Security uses MITRE ATT&CK rather than just hanging a poster on the SOC wall. What is the primary mechanism?
Select an answer to reveal the explanation.
Short Explanation
ATT&CK on the wall is a poster; ATT&CK in ES is a tag on the detection. Annotations glue tactic and technique onto correlation searches so the notable and the risk story speak ATT&CK. Splunk does not invent a replacement matrix.
Full Explanation
Enterprise Security primarily incorporates MITRE ATT&CK by annotating detections and correlation searches so notables and risk stories carry tactic and technique labels. For a city CISO, that is the difference between a wall poster and an operational framework: ATT&CK becomes metadata that travels with civic detections into the analyst workflow. Annotations make coverage measurable and investigations navigable without inventing a Splunk-only attack matrix.
Claiming Splunk replaces MITRE and ships its own matrix as a CIM data model fails by concept: CIM is a normalization schema, not a substitute ATT&CK framework. Claiming Analysts paste ATT&CK PDF pages into comments fails by concept: informal pasting is not the primary ES mechanism and does not scale coverage. Claiming that installing an ATT&CK add-on alone fills every coverage gap with no detections fails by concept: add-ons without annotated, data-backed detections do not create real coverage.
Exam caveat: ATT&CK in ES = annotations on detections/content that surface on notables and risk; not CIM replacement, not PDF pasting, not install-and-done.
Operational check: Require ATT&CK tactic/technique annotations on new municipal correlation searches, verify they appear on sample notables and risk stories, and use gaps in annotated enabled content—not posters—to drive coverage work.