Findings Table: Threat Behaviors tab

Bitsight Threat Insights associates findings with threat behaviors. A threat behavior is a tactic, technique, or procedure (TTP) that attackers use, as defined in the MITRE ATT&CK framework. This article explains what threat behaviors are and where Security Posture Management (SPM) and Continuous Monitoring (CM) show them.

Applies to: Security Posture Management and Continuous Monitoring

Before you begin

• You need access to Threat Insights in SPM or CM.
• Threat Insights does not change scores or ratings. Threat behaviors support prioritization only.
• Threat Insights associations are probabilistic. They reflect observed attacker behavior, historical patterns, and public frameworks. They represent likelihood and relevance, not certainty.

What is a threat behavior?

A threat behavior is a TTP: a tactic, technique, or procedure. Tactics describe an attacker's goal, techniques describe how the attacker pursues the goal, and procedures describe specific implementations. Bitsight maps findings to TTPs from the MITRE ATT&CK framework.

A finding is associated with a threat behavior when the issue of the finding can be exploited using that TTP.

How do I view the threat behaviors on the findings table?

In SPM

1. In the left menu, select Findings.
2. Select Threat Insights.
3. Select the Threat Behaviors tab.

In CM

1. Select the company.
2. Open Findings -> Threat Insights page.
3. Select the Threat Behaviors tab.