MITRE ATT&CK

MITRE ATT&CK maps Trisul's network detections onto the MITRE ATT&CK framework, so instead of just seeing "an alert fired" you see which known adversary technique it lines up with. There's also a companion timeline view that lays these mapped detections out chronologically, so you can see how an intrusion actually unfolded.

To see which ATT&CK technique each alert maps to, browsable by tactic, see MITRE ATT&CK Framework Integration in the User Guide.

To see mapped detections in time order, so you can trace how an intrusion unfolded, see MITRE ATT&CK Alert Timeline in the User Guide.