Before
Analysts likely had to request collection information, inspect tracked objects, and identify new activity manually. They then had to prepare the relevant links and compose a summary before sharing it with the team in Slack.
How it works
- Receive the triggering event and retrieve ATT&CK collection information and tracked object types from the TAXII service.
- Iterate through the collections, extract new objects, and format the relevant content and links for distribution.
- Post a concise activity overview to a Slack channel for team review.
Workflow details
- Trigger and framework retrieval: The workflow starts from an incoming emailhook event, then requests collection information and tracked ATT&CK types from the TAXII service.
- Collection and object processing: It iterates through the available collections, retrieves their objects, and extracts the new objects that should be highlighted for review.
- Content preparation: The extracted activity is transformed into a concise overview, with URLs converted from Markdown into Jira-compatible Markdown before delivery.
- Team notification: The prepared summary is posted to a Slack channel so security or intelligence teams can review newly identified ATT&CK activity in a shared location.
What changed
ATT&CK collection retrieval, object extraction, link formatting, and Slack delivery now occur as one automated workflow after the triggering event. The team receives a prepared activity overview without a manual collection review and message-building handoff.
Work removed
Repeatedly retrieving collection data, reviewing collections and objects individually, extracting new ATT&CK activity, reformatting links, composing the summary, and manually posting the update to Slack.
Expected outcome
A repeatable, consistently formatted Slack briefing of new ATT&CK activity is produced for each workflow run, removing several recurring review and notification actions.
