A city SOC inventories only file hashes from a library incident and has no technique IDs. What must it add before it can describe the campaign in the industry's common TTP language?
Select an answer to reveal the explanation.
Short Explanation
A drawer full of fingerprints is not a playbook. Hashes are clues; ATT&CK technique IDs are the shared language other SOCs use to say what the actor actually did.
Full Explanation
MITRE ATT&CK is the industry's common language for techniques. File hashes are technical indicators; they do not by themselves map a campaign onto tactics and techniques. Until the city SOC assigns ATT&CK technique IDs to the observed behaviors, it cannot describe or share the campaign as TTPs. Extra hashes, Kill Chain numbers stored as sourcetypes, and Diamond victim names do not substitute for that technique mapping.