Accuracy in attack technique labeling in an extended detection system

Abstract

Techniques for providing a confidence rating for an attack technique tag and a guidance for improving the confidence rating are described. An attack technique analytics engine receives telemetry data, a notification that an attack has been detected using an attack detection source, the notification including an attack technique tag indicating an attack technique used in the attack, and attack technique data including a likelihood of a particular attack technique, from among multiple attack techniques, occurring determined using a particular attack detection source from among multiple attack detection sources. Based on the telemetry, the attack technique tag, and the attack technique data, a confidence rating that the attack corresponds to the attack technique is determined. The attack detection source and attack technique are analyzed to determine a guidance for improving the confidence rating, and the rating and guidance are appended to the attack technique tag.