29:null 2a:["$","title",null,{"children":"Attack Flow: Tactic Table | MITRE Center for Threat-Informed Defense | Observable"}] 2f:Tafb,tableMarkup = { if (!groupedTechniques) { return html`Please select an Attack Flow file to get started…`; } const root = d3.create("div"); // Create a div for each tactic with a heading and a table const tacticDivs = root .selectAll(".tactic") .data(groupedTechniques) .join("div") .attr("class", "tactic") .style("margin-bottom", "30px"); tacticDivs .append("h3") .text((data, idx) => { const {tactic, techniques} = data; let header; if (tactic.domain) { header = `Table ${idx + 1}: ${tactic.id} - ${tactic.name} (${tactic.domain})`; } else { header = `Table ${idx + 1}: ${tactic.id} - ${tactic.name}`; } return header; }); const tacticTables = tacticDivs .append("table"); // Add the table header to each tactic table const thead = tacticTables .append("thead") .append("tr") .style("background-color", headerBackgroundColor); thead.append("th") .text("Technique Name") .style("padding", "5px") .style("color", headerTextColor) .attr("width", "25%"); thead.append("th") .text("ATT&CK ID") .style("padding", "5px") .style("color", headerTextColor) .attr("width", "15%"); thead.append("th") .text("Use") .style("padding", "5px") .style("color", headerTextColor) .attr("width", "50%"); // Add the technique rows to each tactic table const techniqueRows = tacticTables .append("tbody") .selectAll("tr") .data(d => d.techniques) .join("tr"); techniqueRows .append("td") .style("padding", "5px") .text(t => t.name); techniqueRows .append("td") .style("padding", "5px") .append("a") .attr("href", t => getTechniqueUrl(t.id)) .attr("target", "_blank") .text(t => t.id); techniqueRows .append("td") .style("padding", "5px") .text(t => t.description); const copyButton = html``; copyButton.onclick = async () => { const blob = new Blob([root.node().innerHTML], { type: "text/html" }); navigator.clipboard.write([new ClipboardItem({ [blob.type]: blob })]); copyButton.textContent = "✅ Copied!"; setTimeout(() => copyButton.textContent = "📋 Copy SVG", 1500); }; return html`

${copyButton}

${root.node()}

`; }30:[{"id":"e837ab279c80d5a039cc683545f7066713f992f1e40086cb97e8890cd5fe75b2b59f3d6f3e5c65260e96562c6c4236c697d6fb142af356330d916faa6d3d0e7d","href":"https://static.observableusercontent.com/files/e837ab279c80d5a039cc683545f7066713f992f1e40086cb97e8890cd5fe75b2b59f3d6f3e5c65260e96562c6c4236c697d6fb142af356330d916faa6d3d0e7d","name":"tactics@1.json","type":"application/json","lastModified":1744656865819.863,"size":2941}] 2d:{"id":"010f86f3168a6b83","slug":null,"title":"Attack Flow: Tactic Table","thumbnail":"8b425f46d7fca877f300959ff69497b29dae4e996c06ebb1a54f77bfdb9c1740","access_level":"public","create_time":"$D2025-04-14T16:02:00.732Z","update_time":"$D2025-07-22T17:25:11.331Z","view_time":null,"first_public_time":"$D2025-07-03T15:04:22.893Z","fork":true,"stars":1,"starred":false,"owner":{"type":"team","id":"f0049cade5d2fe99","login":"center-for-threat-informed-defense","name":"MITRE Center for Threat-Informed Defense","avatar_url":"https://avatars-next.observableusercontent.com/3b469a4cc1bde42906cdf9cb8b1febfc36ddbfd46ac8a67b6d52081ac91c8e21","tier":"starter_2024"},"version":533,"publish_version":null,"role":null,"authored":false,"authors":[{"type":"individual","id":"c59e216253a2d162","login":"mehaase","name":"Mark E. Haase","avatar_url":"https://avatars-next.observableusercontent.com/8d4400329a9badef98ce12aebc71bb070afbfa4a6a54ddad5190fb0399a0d633","tier":null}],"members":[{"type":"team","id":"f0049cade5d2fe99","login":"center-for-threat-informed-defense","name":"MITRE Center for Threat-Informed Defense","avatar_url":"https://avatars-next.observableusercontent.com/3b469a4cc1bde42906cdf9cb8b1febfc36ddbfd46ac8a67b6d52081ac91c8e21","tier":"starter_2024","role":"editor"},{"type":"individual","id":"c59e216253a2d162","login":"mehaase","name":"Mark E. Haase","avatar_url":"https://avatars-next.observableusercontent.com/8d4400329a9badef98ce12aebc71bb070afbfa4a6a54ddad5190fb0399a0d633","tier":null,"role":"editor"}],"comments":[],"custom_thumbnail":false,"trashed":false,"lapsed":null,"subscribed":null,"forks":2,"collection":null,"type":"notebook","body":{"title":"Attack Flow: Tactic Table","cells":[{"id":0,"value":"# Attack Flow: Tactic Table\n\n","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":298,"value":"## Introduction\n\nOn this page, you can generate a tactic table automatically from an Attack Flow. The tactic table is inspired by the format that CISA uses in their cybersecurity advisories. (See [example here](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a#:~:text=for%20ransom%20negotiation-,MITRE%20ATT%26CK%20Tactics%20and%20Techniques,-See%20Table%203).)\n\n## How to Use It\n\nFirst, open a flow in the Attack Flow Builder and choose \"File → Export STIX File\" to save the flow in `.json` format. **Note that the flow must contain tactic and technique IDs.** Next, upload that `.json` file here to generate a tactic table.","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":4,"value":"viewof uploadedFile = Inputs.file({\n label: \"Select an Attack Flow (.json)\",\n accept: \".json\"\n})\n","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":457,"value":"viewof headerTextColor = Inputs.color({label: \"Table header text\", value: \"#F1F3F4\"});","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":466,"value":"viewof headerBackgroundColor = Inputs.color({label: \"Table header background\", value: \"#005B94\"});","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":377,"value":"$2f","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":83,"value":"--- \n\n## Code 👩‍🔬\n\nEverything from here down is the support code used to run this page. If you are a developer, you may find this interesting, but for most audiences you can simply ignore it.","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":6,"value":"data = uploadedFile ? uploadedFile.json() : null\n","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":165,"value":"groupedTechniques = {\n if (!data) {\n return null\n };\n \n const actions = data.objects.filter(item => item.type === \"attack-action\");\n const grouped = {};\n\n actions.forEach(action => {\n if (!action[\"technique_id\"]) {\n return;\n }\n \n let tacticId = action[\"tactic_id\"] || \"(NA)\";\n const tactic = tactics[tacticId] || {\n id: tacticId,\n name: \"(Tactic Not Provided)\",\n order: 99,\n domain: null,\n }\n\n if (!grouped[tacticId]) {\n grouped[tacticId] = {\n tactic,\n techniques: new Array(),\n }\n }\n\n grouped[tacticId].techniques.push({\n id: action.technique_id,\n name: action.name,\n description: action.description,\n });\n });\n\n const tacticGroups = new Array();\n for (const [tacticId, data] of Object.entries(grouped)) {\n tacticGroups.push({\n tactic: data.tactic,\n techniques: data.techniques,\n });\n }\n tacticGroups.sort((a,b) => a.tactic.order - b.tactic.order);\n \n return tacticGroups;\n}\n","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":407,"value":"tactics = FileAttachment(\"tactics@1.json\").json()","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":519,"value":"function getTechniqueUrl(techniqueId) {\n return `https://attack.mitre.org/techniques/${techniqueId.replace('.', '/')}/`;\n}","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"}],"files":"$W30","stdlib":"1","titling":"auto"}} 2e:"$2d:body"