Manage Attack Techniques

You can manage attack techniques in the following ways:

You can change the status of one, several, or all attack techniques on the Top Attack Techniques tab on the Attack Paths page.

To change the status of an attack technique:

  1. Access the Top Attack Techniques tab.

  2. Do one of the following:

    • In the Top Attack Techniques list, next to the attack technique for which you want to change the status, click the button.

      A menu appears.

      1. Click Change Status.

    • In the Top Attack Techniques list, select the check box next to each attack technique for which you want to change the status.

      1. At the top of the list, click More.

        A menu appears.

      2. Click Change Status.

    A menu appears.

  3. Click the status to which you want to change the attack technique, for example, In Progress.

    Tenable Exposure Management updates the status of the attack technique.

You can export one or more attack techniques on the Top Attack Techniques tab on the Attack Paths page. The export file includes information from the currently visible columns in the list. By default, Tenable Exposure Management also includes the following items in the export file:

  • mitreURL

  • state

  • vectorCount

To export an attack technique:

  1. Access the Top Attack Techniques tab.

  2. Do one of the following:

    • In the Top Attack Techniques list, next to the attack technique you want to archive, click the button.

      A menu appears.

      1. Click Export as CSV.

    • In the Top Attack Techniques list, select the check box next to each attack technique you want to export.

      1. At the top of the list, click Export Selected.

    Tenable Exposure Management downloads the export file to your computer. Depending on your browser settings, your browser may notify you that the download is complete.

You can use the Log History page to view the following details for an attack technique:

  • State changes, whether Open or Archived.

  • Any change in the status: To Do, In Progress, In Review, Or Done.

  • Changes in the priority level: Critical, High, Medium, or Low.

The priority of an attack technique can change for a number of reasons, including a change in the number of targets, sources, attack paths, or critical assets. Priority can also change if the target or source is renamed.

Deactivated Attack Techniques: In cases where attack path data does not exist outside of the Top Attack Techniques list, Tenable Exposure Management automatically updates the Log History of the attack technique:

  • When a attack technique is not seen as part of any attack path, Tenable Exposure Management changes the attack technique State to Archived.
  • When a attack technique cannot be found within the Attack Path Graph on the Top Attack Paths tab, Tenable Exposure Management changes the attack technique State to Archived and the Status to Done.

If at any point the attack technique is again seen as part of an attack path, Tenable Exposure Management automatically reactivates the attack technique State to Open.

To view the log history of an attack technique:

  1. Access the Top Attack Techniques tab.

  2. In the Top Attack Techniques list, in the row of the attack technique for which you want to view the log history, click the button.

    A menu appears.

  3. Click Log History.

    The Log History page appears, where you can view a reverse chronological list of attack technique updates. To refresh the details on the page, click the icon.

The following is not supported in Tenable FedRAMP Moderate environments. For more information, see the Tenable FedRAMP Product Offering.

Tenable Exposure Management allows you to add comments on any section of the attack technique details page and share it with other users in your organization. You can address your comment to a specific user and receive replies to your comment. Tenable Exposure Management also notifies you whenever someone replies to your comment or when new comments are added.

To comment on an attack technique:

  1. Access the Top Attack Techniques tab.

  2. Click the attack technique that you want to comment on.

    The attack technique details page appears.

  3. Do one of the following:

    1. In the upper-right corner of the view, click the button.

    2. Scroll to the section on which you want to comment and click the button.

      The Comments pane appears.

  4. In the text box, type your comment.

    Note: You can send your comment to another user by prefixing @ before the user's email ID.

  5. (Optional) To include a snapshot of the section on which you want to comment, select the Include snapshot check box.

  6. Click the button.

    Tenable Exposure Management posts your comment and notifies other users about your comment.

What to do next

Whenever someone posts a comment, the icon in the upper-right corner shows a blue dot indicating that you have new comments.

To view the comments, click the icon to open the Comments pane. When you click a comment, Tenable Exposure Management directs you to the section including the newly added comment.

You can archive one, several, or all attack techniques on the Top Attack Techniques tab on the Attack Paths page. By archiving an attack technique, you are effectively accepting the risk of the attack technique as part of attack paths within Tenable Exposure Management.

Note: Tenable Exposure Management automatically archives attack techniques that are no longer part of any attack paths. For more information, see Log History.

To archive an attack technique:

  1. Access the Top Attack Techniques tab.

  2. Do one of the following:

    • In the Top Attack Techniques list, next to the attack technique you want to archive, click the button.

      A menu appears.

      1. Click Move to Archived.

    • In the Top Attack Techniques list, select the check box next to each attack technique you want to archive.

      1. At the top of the list, click More.

        A menu appears.

      2. Click Move to Archived.

    A confirmation message appears.

  3. Click Move to Archived.

    Tenable Exposure Management moves the attack technique to the Archived Attack Techniques section.

Tip: View the Log History to see the movement history of any given attack technique.