Mitre Attack Tactics Observed

Events mapped against MITRE ATT&CK Tactics that have been observed in the environment, with percentage of total.

KQL Library  /  MITRE ATT&CK

 MITRE ATT&CK mitre-attack-tactics-observed.kql

Events mapped against MITRE ATT&CK Tactics that have been observed in the environment, with percentage of total.

Platforms Microsoft Sentinel
Data SecurityAlert
Deep Dive  Deep Dive
 Deep Dive  Download .kql 
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// Source: KQL Toolbox #7: From Detection Coverage To Response Reality (2026-02-08) — https://www.hanley.cloud/2026-02-08-KQL-Toolbox-7-From-Detection-Coverage-to-Response-Reality/
// This query identifies events mapped against the MITRE ATT&CK Matrix that have been observed in the environment
// Platforms: Microsoft Sentinel
// Data: SecurityAlert

let totalCount = toscalar(
    SecurityAlert
    | where TimeGenerated > ago(90d)
    | where isnotempty(Tactics)
    | mv-expand tactic = split(Tactics, ", ")
    | summarize Total = count()
    );
SecurityAlert
| where TimeGenerated > ago(90d)
| where isnotempty(Tactics)
| mv-expand tactic = split(Tactics, ", ")
| summarize Count = count() by tostring(tactic)
| extend Percentage = strcat(round(Count * 100.0 / totalCount, 2), '%')
| extend TacticEmoji = case(
                           tactic == "InitialAccess",
                           "🚪",
                           tactic == "Execution",
                           "💥",
                           tactic == "Persistence",
                           "📌",
                           tactic == "PrivilegeEscalation",
                           "🚀",
                           tactic == "DefenseEvasion",
                           "🕵️",
                           tactic == "CredentialAccess",
                           "🔑",
                           tactic == "Discovery",
                           "🔍",
                           tactic == "LateralMovement",
                           "🔄",
                           tactic == "Collection",
                           "📂",
                           tactic == "Exfiltration",
                           "📤",
                           tactic == "Impact",
                           "⚡",
                           tactic == "CommandAndControl",
                           "📡",
                           "❓"  // Default emoji for unknown tactics
                       )
| project Tactic = strcat(TacticEmoji, " ", tactic), Count, Percentage
| sort by Count desc
| top 10 by Count