Attack library
Use the Attack Library and coverage views
Find the techniques relevant to your agent and understand what Martian can execute in the current catalogue. The expected result is a clearly scoped assessment selection, with unsupported techniques and declared gaps kept visible.
Before you start
Section titled “Before you start”Any signed-in tenant role can inspect Attack Library and Threat Intel. Member or above is required to launch an assessment from an approved agent. Catalogue entries, taxonomy mappings and prior findings do not by themselves authorize testing or certify compliance.
Explore technique coverage
Section titled “Explore technique coverage”- Open Attack Library. Inspect its catalogue statistics and coverage matrix rather than treating every listed item as a runnable test.
- Use the available taxonomy view, such as MITRE ATLAS or OWASP, to inspect the published classification. Framework mappings organize material; they are not a compliance assessment or an exhaustive guarantee.
- Open a technique and read its supported surface, outcome and current coverage. A technique marked unavailable remains disabled for execution.
The observed catalogue offered MT-01 Direct instruction override as In the library, with Add to assessment enabled. MT-20 Session hijack was a Declared gap, with that action disabled. These are catalogue states, not findings about the teaching target.
The source-visible Add to assessment shortcut opens the wizard’s Tests step in By technique mode with that technique selected. Confirm the preselection, then review Environment, Agent and Goals before launching. This shortcut is separate from the manually selected path below and was not independently exercised in the recorded catalogue walkthrough.
- In New assessment → Tests → By technique, search by name, ID or surface and choose available techniques that match the authorized target. Confirm the final selected count and actual budget before Start assessment.
- After a run, compare requested scope with Probe coverage and actual target attempts. Catalogue membership and a selected checkbox do not prove execution or successful verification.
Understand the source of the catalogue
Section titled “Understand the source of the catalogue”The customer Attack Library reads the stored Backend technique and published-attack catalogue. It is not a live mirror of the researcher Wiki. A selected compatible scenario can use published Wiki material, while review/submission and customer execution remain separate workflows.
Do not treat a newly discussed or submitted Wiki case as automatically available in this customer catalogue. If expected content is missing, ask your operator which reviewed catalogue/scenario revision is available in your environment.
Read Threat Intel accurately
Section titled “Read Threat Intel accurately”- Open Threat Intel.
- Read No live feed connected when shown. Current catalogue statistics and declared gaps are reference/coverage context; this screen does not establish a running external threat-ingestion feed.
- Follow an actual assessment’s retained findings/evidence to investigate a fleet signal. Use history and exports to locate the underlying run.
Verify and recover
Section titled “Verify and recover”Refresh the catalogue, repeat the intended search and check that the displayed selection corresponds to the same available technique IDs. A missing catalogue/error state needs service or publication repair; do not substitute invented coverage. An uncovered technique, no findings or an empty feed is not evidence that the agent is secure or no relevant attack exists.
Continue with configure an assessment and interpret reproduction and coverage.