Observed Attack Techniques

The Observed Attack Techniques app displays the individual events detected in your environment that may trigger an alert and any related MITRE information.

Trend Micro Vision One detects events through use of granular detection filters that make up the detection models that trigger alerts. Events that Trend Micro Vision One lists on the Observed Attack Techniques screen do not necessarily result in a Workbench alert. You can use the data in the Trend Micro Vision One app to further investigate Workbench alerts and evaluate individual detections.

The following table outlines the actions available in the Observed Attack Techniques app.

Action

Description

Filter event data

Use the Endpoint name field and drop-down lists to locate specific event data.

  • Risk level: The risk assigned to the detection filter as determined by Trend Micro threat experts

    Important:

    Trend Micro experts continuously assess threats and may update the risk level of a detection at any time, based on the latest information available.

  • Detected: When the detection occurred

  • Detection filter: Select from Detection filter, Tactic ID, or Technique ID to locate specific filter or MITRE data

Hide detection filters from the list

If you receive a lot of detections on particular detection filters that do not interest you, you can temporarily hide the data for specific filters.

Right-click the unwanted Detection filter name and click Hide Value. After adding all unwanted filters to the Hidden objects list, click Apply to reload the screen.

Note:

You cannot save the Hidden objects list. If you leave the screen, the list resets.

View event in Search app

Click the View Event in Search icon () to open the Search app in a new tab and view more details.

View more details

Expand any row to see more details related to the detection.