| name | mitre-attack-mapping |
| description | Use for PcapRaven MITRE ATT&CK Enterprise Matrix v19.2 mapping provenance, validation, and explainability. |
MITRE ATT&CK Mapping Skill
This skill documents requirements and procedures for declaring, validating, stamping, and reviewing MITRE ATT&CK mappings in PcapRaven.
Core Invariants
- Enterprise Matrix Version Pinned: Canonical catalog version is MITRE ATT&CK Enterprise Matrix
v19.2. Object versions are explicitly typed (MitreAttackObjectVersion, e.g., 1.4).
- Domain & Relationship Semantics: Domain is strictly
MitreAttackDomain::Enterprise. Relationship is strictly MitreAttackRelationship::Analytical (heuristics indicate analytical alignment with technique behavior, not confirmed intrusion/adversary attribution).
- Declaration Provenance Ownership:
- Detectors and correlators declare mappings statically on their metadata (
DetectorMetadata, CorrelatorMetadata) via MitreMappingDeclaration.
FindingDraft and CorrelationDraft do not carry MitreMappings.- The
DetectionEngine stamps final MitreMappings onto accepted FindingRecords with explicit MitreMappingProvenance::DetectorDeclared or MitreMappingProvenance::CorrelatorDeclared.
- Strict Identifier Syntax:
MitreAttackId must strictly match T#### (e.g. T1071) or T####.### (e.g. T1071.004). No leading or trailing whitespace is accepted (trim() is prohibited).
- Bounded Technique Names and Rationales: Technique names and rationales are strictly bounded and cannot contain ASCII control characters.
- No Floating-Point Arithmetic: Zero
f32/f64 usage in mapping representations.
