In the MITRE ATT & CK framework, which term describes the specific high-level "Why" or...

The MITRE ATT & CK framework is categorized into a hierarchy that helps SOC analysts understand attacker behavior:

Tactic (B): This is the objective/goal of the attacker. There are currently 14 tactics in the Enterprise matrix, including Reconnaissance, Persistence, and Lateral Movement. It answers the question "What is the attacker trying to achieve?"

Technique (A): This is the "How"—the specific method used to achieve a tactic (e.g., "Spearphishing Attachment" to achieve "Initial Access").

Procedure (C): The specific implementation or "recipe" used by a particular threat actor (e.g., "APT28 used a specific PowerShell script to bypass AMSI").

Mapping: Cortex XDR and XSIAM natively map alerts to these Tactics and Techniques to help analysts quickly understand the stage and intent of an attack.