mapped: 0 / 81 — formal coverage exists only at the fingerprint level so far.
Fortigate_Webfilter_Malicious_Websites is now mapped to T1189 Drive-by Compromise (251 cases). Account-manipulation and email-collection fingerprints also have formal T1098 / T1136 / T1114 mappings. The remaining 13 high-volume fingerprints still need mapping work; this report uses inferred mappings for those rows, clearly badged.
mapped: 0 / 81. Formal mappings exist at the fingerprint level only — driven by Fluency's internal fingerprint analysis. To make signature-level coverage non-zero, run propose_signature_mitre_mapping_candidates (a draft-only step) and then approve_signature_mitre_mapping per signature. That work persists into the catalog and removes the inference label on the next run.
| # | Tactic | Technique | Name | Driving signature | Cases | Basis | Volume |
|---|---|---|---|---|---|---|---|
| 01 | Initial Access | T1189 | Drive-by Compromise | Fortigate_Webfilter_Malicious_Websites | 252 | Formal | |
| 02 | Initial Access | T1078.004 | Cloud Accounts (Valid) | O365_AzureAD_UserLoggedIn | 200 | Inferred | |
| 03 | Execution | T1053.005 | Scheduled Task — Created | AD_Scheduled_Task_Created | 144 | Formal | |
| 04 | Defense Evasion | T1070 | Indicator Removal — Task Deleted | AD_Scheduled_Task_Deleted | 144 | Inferred | |
| 05 | Defense Evasion | T1070 | Indicator Removal — win task del | win_scheduled_task_deletion | 144 | Inferred | |
| 06 | Execution | T1047 | Windows Mgmt Instrumentation | posh_ps_suspicious_gwmi | 141 | Formal | |
| 07 | Defense Evasion | T1562 | Impair Defenses — admin config | FortiGate_Config_Changed_By_Admin | 118 | Inferred | |
| 08 | Defense Evasion | T1562 | Impair Defenses — description | FortiGate_Config_Changed_Description | 118 | Inferred | |
| 09 | Defense Evasion | T1553 | Subvert Trust Controls | win_susp_codeintegrity_check_failure | 101 | Formal* | |
| 10 | Impact | T1529 | System Shutdown / Reboot | AD_SystemShutdown | 99 | Inferred | |
| 11 | Defense Evasion | T1562.002 | Disable Windows Event Logging | AD_EventLogServiceStarted | 96 | Formal* | |
| 12 | Defense Evasion | T1562.002 | Disable Windows Event Logging | AD_EventLogServiceStopped | 96 | Formal* | |
| 13 | Credential Access | T1110 | Brute Force | win_susp_failed_logon_reason | 73 | Inferred | |
| 14 | Discovery | T1083 | File and Directory Discovery | posh_ps_file_and_directory_discovery | 73 | Inferred | |
| 15 | Defense Evasion | T1070.004 | File Deletion | posh_ps_remove_item_path | 65 | Inferred | |
| 16 | C2 | T1105 | Ingress Tool Transfer — web req | posh_ps_web_request | 61 | Formal* | |
| 17 | Defense Evasion | T1562.001 | Disable or Modify Tools | posh_ps_set_policies_to_unsecure_level | 60 | Formal* | |
| 18 | Defense Evasion | T1562 | Impair Defenses — task disabled | AD_Scheduled_Task_Disabled | 53 | Inferred | |
| 19 | Execution | T1053.005 | Scheduled Task — Enabled | AD_Scheduled_Task_Enabled | 52 | Inferred | |
| 20 | C2 | T1105 | Ingress Tool Transfer — download | posh_ps_suspicious_download | 37 | Inferred | |
| 21 | Lateral Movement | T1021.001 | Remote Desktop Protocol | win_admin_rdp_login | 35 | Formal* | |
| 22 | Persistence | T1098 | Account Manipulation | O365_User_Updated | 35 | Formal | |
| 23 | Collection | T1560 | Archive Collected Data | posh_ps_suspicious_extracting | 29 | Inferred | |
| 24 | Persistence | T1098.003 | Add to Privileged Group | O365_AzureAD_Add_Member_To_Group | 25 | Inferred | |
| 25 | Initial Access | T1190 | Exploit Public-Facing App (blocked) | Fortigate_Inbound_Denied_IDS | 24 | Inferred |
Source. Fluency MSSP MCP — connector 00000000-0000-0000-0000-000000000000 (Apex MSSP). Figures derived from summarize_case_metrics, summarize_case_fingerprints (top 25, with fingerprint-level mitre_attack arrays), summarize_signature_attack_coverage, and list_signature_mitre_gaps at connector scope.
Scope. 1,043 cases with status="closed" and riskScore ≥ 3,000 across 13 tenants (customer-04, customer-12, customer-06, customer-02, customer-03, customer-13, customer-07, customer-11, customer-09, customer-05, customer-01, customer-10, customer-08). Window: 2026-05-01T00:00Z → 2026-05-31 (to current time). Four Apex MSSP tenants (customer-14, customer-15, customer-16, customer-17) had no qualifying cases.
Mapping basis — mixed. 12 of the top 25 fingerprints carry formal ATT&CK mappings from Fluency's fingerprint catalog, covering ~342 cases (33% of monthly volume). Notable formal mappings: T1189 Drive-by Compromise (Fortigate webfilter), T1136 Create Account / T1098 Account Manipulation (O365 user changes), T1114 Email Collection (mailbox permission grants), T1021.001 RDP (admin RDP logins), T1047 WMI + T1053.005 Scheduled Task (posh_ps_suspicious_gwmi + AD task clusters), T1553 Subvert Trust + T1562.002 Disable Event Logging (multi-rule asset clusters). The remaining 13 fingerprints and all single-signature high-volume rules use inferred mappings from rule names. At the signature level, the catalog still reports 0 / 81 mapped — formal coverage exists at the fingerprint level only.
Counting. Tactic and technique counts are signature-case hits: a case firing multiple rules contributes once per rule's mapped tactic. Tactic-volume totals therefore exceed the 1,043 distinct-case denominator.
Recommended next step. Run propose_signature_mitre_mapping_candidates (dry-run first) to draft formal proposals for the 13 unmapped high-volume fingerprints. After analyst review, approve via approve_signature_mitre_mapping to persist into the catalog — the next monthly run will then show signature-level coverage greater than zero and remove most of the Inferred badges from this report.
Known issues. The sync_signature_catalog eventwatch error (Cowork issue [issue-id]) is now resolved; current run shows activity_lookup_errors: {}.
Generated 2026-05-31T07:17Z · Read-only · No Fluency mutations performed.