Canon schema vocabulary

MITRE ATT&CK Technique

extends schema.org/Thing

An ATT&CK Technique (or sub-technique, or tactic) is an entry in the MITRE ATT&CK knowledge base of adversary behaviour, identified by a technique id such as T1003 (OS Credential Dumping) or a tactic id such as TA0006 (Credential Access). On Whisper Internet Directory, each is published at /attack/{id} as a schema.org Thing, carrying its tactic(s), parent or sub-techniques, and the threat actors observed using it — sourced from the MITRE ATT&CK corpus in WhisperGraph. © The MITRE Corporation; reproduced and distributed with permission.

About this type identifier

This page is the canonical definition of the MITRE ATT&CK Technique type in the Whisper Internet Directory vocabulary. Every /attack entity page references it from its structured data via the additionalType field, extending the schema.org Thing base type so crawlers and LLMs can resolve the Canon-specific meaning of the entity.

Type identifier (IRI): https://canon.whisper.security/schema/AttackPattern
schema.org base type: Thing
Entity pages: /attack/{id}

Example MITRE ATT&CK Technique pages

Representative entities of this type in the Whisper Internet Directory directory.