Relationship for x-mitre-tactic SDOs? about cti HOT 1 CLOSED

HI @andreamargheri - this is a good question and point.

When we originally generated the STIX content for ATT&CK, the tactics were not included as separate objects. Instead they were simply found in the kill-chain-phase attribute of the attack-patterns. Because of this, when we did generate these custom x-mitre-tactic objects, we left the kill-chain-phase attributes as is and matched on that vs. generating relationships since users had already been using that method to map the objects.

When we do our update to ATT&CK to include subtechniques we may consider going a different route, but we'll provide guidance at that point on the best way to do this matching. Thanks!

from cti.