MITRE Tactic Incident
Query
//Displaying the MITRE tactics assigned to Incidents
SecurityIncident
| extend MITRE_ = tostring(parse_json(tostring(AdditionalData.tactics))[0])
| project IncidentNumber, Title, MITRE_Explanation
This query displays the MITRE tactics assigned to security incidents. It retrieves the incident number, title, and the corresponding MITRE tactic for each incident.
Details
Rod Trent
Released: March 16, 2022
Tables
SecurityIncident
Keywords
SecurityIncidentAdditionalDataMITRE_IncidentNumberTitle
Operators
extendtostringparse_json[0]project