Attack Path FAQ

Attack Path currently supports these Tenable products:

• Tenable One Vulnerability Management

• Tenable Security Center

• Tenable One Web App Scanning

• Tenable One Cloud Exposure

• Tenable One Identity Exposure

• Tenable One Attack Surface Management

• Tenable One OT Exposure

An attack path defines a source, a target, and one or more attack techniques leading an attack from the source to the target.

Attack techniques represent 'how' an adversary achieves a tactical goal by performing an action. For example, an adversary may dump credentials to achieve credential access.

For the complete list of attack techniques, see Attack Path Techniques.

Attack Path receives data and pairs it with advanced graph analytics, MITRE ATT&CK™, and Open Web Application Security Project® (OWASP) to map the possible attack techniques.

See the prerequisite section of each attack technique in Attack Path Attack Techniques to find the conditions that must exist for an attack query to run.

A finding is an attack technique that exists in one or more attack paths leading to one or more critical assets.

A choke point is a place where potential attack paths merge together before reaching a critical asset. Attack Path uses a Choke Point Priority metric to determine the criticality of choke points.

The calculation includes mathematical algorithms, to assess the following:

• Likelihood: The number of attack paths using the technique associated with the finding.

• Impact: The number of critical assets that the technique allows an adversary to compromise.

• Method: The tactic associated with the technique such as lateral movement, privilege escalation, etc.

• Path: The starting point and ending point of the technique.

Attack Path determines the asset type as follows:

• Computer, Server, or Workstation — By parsing the operating system type and mapping it to the relevant type to determine if the asset is a Workstation, Server, or Computer.

• Domain Controller — By determining the domain controller through User Account Control.

• Other computer assets— By considering Computer as the base type for unknown assets.

Attack Path triggers a data processing job every 30 minutes. Depending on the size of your data, it can take up to 5 hours for updates to reflect in Attack Path.

The Discover > Query Builder includes the following asset types: