Visualization¶
The Attack Flow Builder offers several tools for visualizing sequences of behaviors. In addition to being able to visualize and save your flows to PNG in the Builder, the following types of visualizations are available under the View menu. All the visualizations support resizing, full screen view, export to SVG, and copy to PNG.
Presentation View¶
With this visualization, you can visualize a large, complex Attack Flow in a single powerpoint slide. We reduce a flow down to just the actions, conditions, and operators, and represent that in a space-saving snake format.
An example Presentation visualization¶
Tactic Table¶
With this visualization, you can generate a tactic table automatically from an Attack Flow. The tactic table is inspired by the format that CISA uses in their cybersecurity advisories. (See example here.) This visualization also supports multiple flows: click to upload another .afb file and see the number of times each technique is used across those flows.
An example Tactic Table¶
STIX IOC Table¶
With this visualization, you can generate a STIX IOC table automatically from an Attack Flow. The STIX IOC table is very similar in format to the Tactic Table visualization, but it lists STIX Objects and Observables instead.
An example STIX IOC Table¶
Matrix View¶
With this visualization, you can automatically generate an ATT&CK Matrix comprised of nodes from an uploaded Attack Flow. If your flow contains multiple frameworks, they will all be combined into a single matrix.
Timeline View¶
On this page, you can generate a timeline visualization automatically from an Attack Flow. The timeline is inspired by examples of timelines used in cyber threat reporting in the wild. This visualization requires each action node to contain a start timestamp.
Treemap View¶
On this page, you can visualize the distribution of techniques across multiple Attack Flows. The data is visualized in a Tree Map, where each technique present in a Flow has its own box, grouped by tactic. The size of each technique’s box in the tree map is proportional to the number of times that technique appeared in the uploaded Flows. The color of each technique’s box is related to the technique’s score from the uploaded Navigator layer. Or, if you don’t upload a Navigator layer, the colors will be determined by tactics.
Legacy Visualizations¶
Some users of Attack Flow may remember visualizations being housed in Observable notebooks. We still have those available to the public, but are no longer maintaining or updating them.