> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/alerts/tactical-alert-matrix.md). # Tactical alert matrix DoControl alerts are based on the MITRE ATT\&CK adversary model and framework, which describes an adversary’s actions to compromise and operate within an enterprise network. In the Alerts page, each DoControl alert is mapped to a specific MITRE ATT\&CK tactic and technique:

Clicking the tactic and technique links opens the relevant MITRE ATT&CK documentation

## About MITRE ATT\&CK MITRE ATT\&CK (Adversarial Tactics, Techniques, and Common Knowledge) is based on real-world observations, and includes a comprehensive matrix of tactics and techniques that help your organization to classify cyberattacks and assess your risk. The matrix expands the knowledge of network defenders and prioritizes network defense by detailing the tactics, techniques, and procedures (TTPs) cyber threats use to gain access and execute their objectives when operating inside a network. The aim of ATT\&CK is to break down and classify attacks clearly and consistently, making it easier to compare them and discover how the attacker exploited networks and endpoints in a successful compromise. With this knowledge at hand, your organization can identify the weak link in your chain of defense, and prioritize security issues based on risk. {% hint style="info" %} For more information, see the MITRE ATT\&CK [SaaS matrix](https://attack.mitre.org/matrices/enterprise/cloud/saas/) and[ FAQs](https://attack.mitre.org/resources/faq/). {% endhint %} Following are the tactics and techniques representing the MITRE ATT\&CK matrix for Enterprise covering cloud-based techniques for the SaaS platform: * MITRE attack tactics that are covered by DoControl alerts are highlighted in **dark gray**. * MITRE attack techniques that are covered by DoControl alerts are highlighted in **purple**.

MITRE ATT&CK SaaS matrix covered by DoControl

## DoControl alert coverage DoControl's alert types address a variety of MITRE ATT\&CK tactics and attack techniques. The following infographic maps DoControl alert types to the relevant SaaS-based MITRE ATT\&CK categories. These alerts help your organization to mitigate the risk and exposure associated with each potential attack.

A **MITRE tactic** represents why an adversary performs an action, or the adversary's tactical goal. For example, an adversary wants to get credential access. A **MITRE attack technique** represents how an adversary achieves a tactical goal by performing an action. For example, an adversary might dump credentials to achieve credential access. The DoControl alert-MITRE ATT\&CK matrix below provides links with more information about each tactic and attack technique:

MITRE tactic	Attack technique	DoControl alert
Initial access	Valid accounts	MFA disabled for a user (DC82) MFA disabled for a team (DC83)
Reconnaissance	Gather Victim Identity Information: Credentials	Password strength requirements changed for team (DC84)
Persistance	Valid accounts	Possible former employee accessed assets (DC30)
Credential access	Unsecured credentials	Encryption keys uploaded to public channels (DC80) Public sharing of encryption keys (DC81)
Collection	Data from information repositories	External sharing of sensitive files (DC3) Shared with private email (DC7) External user shared with 4th party (DC10) Extensive public burst sharing (DC5) Public sharing of sensitive files (DC6) External user publicly shared (DC11) Shared with malicious domain (DC100) Publicly shared by malicious domain (DC102) Unprotected sensitive cloud recording is public (DC105)
Exfiltration	Transfer data to cloud account	Shared with personal email (DC8) Extensive file download by external user (DC14) File download by about-to-leave employee (DC33) Shared by malicious domain (DC101)

{% hint style="info" %} For more information about DoControl alerts, see the DoControl Alert Specifications in **DoControl > Help**. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/risk-management/alerts/tactical-alert-matrix.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.