Skip to content

Tactics, Techniques & Procedures#

TheHive 4.1.0+ is required to use TTPs

Starting with version 4.1.0, TheHive allows to bind Cases to TTPs (Tactics, Techniques & Procedures). The MITRE ATT&CK framework has been chosen to define these TTPs.

Import MITRE ATT&CK patterns#

To access and import MITRE ATT&CK patterns definition, beeing admin or at least have the role managePattern is required.

  1. In the admin organisation, open the ATT&CK Patterns menu

  2. Click on Import MITRE ATT&CK Patterns and select the appropriate file

  3. Ensure patterns are imported


A direct link to the current zip archive of MITRE ATT&CK patterns let you download it quickly from the official github page.


Refer to this page to learn how to add TTPs (Tactics, Techniques and Procedures) to a Case.

Last update: September 6, 2021 07:19:37