Campaign workbench
Turn a campaign report into an evidence-backed MITRE ATT&CK® analysis. Select a passage, choose the behaviour it supports, and explain your mapping.
Your report and analysis stay in this browser tab. Save a project file to keep your work; nothing is saved automatically or uploaded. External source links open only when you click them.
Loading the local ATT&CK catalogue…
1. Read the evidence
Paste up to 200,000 characters. Select a passage, then use it as evidence. Changing the report later makes existing mappings drafts.How to map responsibly
Map what the report describes, rather than what a group usually does. An explicit technique ID is a lead, not a reviewed finding. Choose a sub-technique only when the evidence supports that detail.
Tactics describe objectives. Their display order does not prove the order of an attack. Technique overlap does not establish attribution. Reviewed means you checked a mapping; it is not independent verification.
This first version covers Enterprise ATT&CK. It does not infer actors, generate detection rules, or claim defensive coverage.
CISA mapping guidance2. Map the behaviour
3. Review your analysis
No mappings yet.
Only reviewed mappings enter the Navigator export. Project files include drafts and the report text.
ATT&CK content: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Licence and limitations. SentryFeed is an independent tool.