Wazuh MITRE ATT&CK Mapping (Built-in Coverage)

Wazuh ships with MITRE ATT&CK metadata embedded directly in the ruleset. Every rule that detects a known TTP has a <mitre><id>Txxxx</id></mitre> block, and the dashboard MITRE module visualizes coverage and detected techniques over time.

1. Open the MITRE module

In the Wazuh dashboard navigate to Threat Hunting -> MITRE ATT&CK. You will see Intelligence (full matrix), Framework (techniques you have rules for) and Dashboard (techniques actually triggered in your environment).

2. Tag your own rules with MITRE IDs

<rule id="100050" level="10">
  <decoded_as>myapp</decoded_as>
  <field name="action">privilege_escalation</field>
  <description>MyApp: privilege escalation attempt</description>
  <mitre>
    <id>T1068</id>
  </mitre>
</rule>

3. Restart the manager

systemctl restart wazuh-manager

We run MITRE ATT&CK coverage assessments and close gaps with custom Wazuh rules, contact us.