Overview
This article explains the Finding Distribution by MITRE ATT&CK section in the Findings Dashboard.
It helps you understand which stages of the attack chain are most exposed in your environment — using the MITRE ATT&CK framework as a reference model.
Details
The MITRE ATT&CK distribution groups your findings according to tactics — categories of attacker behavior like:
Initial Access
Execution
Privilege Escalation
Lateral Movement
Persistence
And others from the MITRE ATT&CK knowledge base
Each finding is mapped to one or more of these tactics based on its characteristics and potential exploit behavior.
This view helps you spot:
Which phases of the attack lifecycle are most vulnerable
Gaps in your defenses for specific adversary tactics
Where to focus mitigation to break common attack chains
Wrap-up / Next Steps
Use this view to align your security efforts with real-world attack behavior. It’s a valuable lens for both operational teams and strategic planning — especially if you're building or reviewing your defense-in-depth strategy.