mitre attack
AI security interview questions tagged mitre attack, across every topic.
3 questions · 1 unlocked for you
Concepts behind "mitre attack"
Explanations of the mechanisms these questions rely on.
Foundational
Detection Engineering: From Hypothesis to Tested AlertDetection engineering turns knowledge of attacker behaviour into reliable alerts. Each detection starts from a behaviour attackers cannot easily avoid, depends on a data source that is confirmed to record it on the relevant assets, is tuned against history with narrow, owned exceptions, is tested by emulating the technique, and ships with a runbook and metrics. Managed as code, detections are reviewed, tested end to end, rolled out in shadow mode and retired when they stop earning their cost; ATT&CK is used to prioritise and to find gaps, not to colour a heatmap. Detection & Response
Core
MITRE ATT&CK and Sigma: a Shared Language for DetectionsMITRE ATT&CK is a knowledge base of adversary behaviour organised as tactics (goals) and techniques (how), now linked to detection strategies and the telemetry needed. Its 2026 releases split Defense Evasion into Stealth and Defense Impairment, giving Enterprise 15 tactics, and added AI-focused techniques. Sigma is a vendor-neutral rule format: a detection is written once in YAML and converted for each SIEM, with correlation rules for counts and sequences. Coverage means tested detections on collected data, not coloured cells. Detection & ResponseSign in