Auto-tag security cases with MITRE ATT&CK techniques
Build a workflow callable via Send-to-Story that takes an alert's description and returns the relevant MITRE ATT&CK techniques and tactics. Add a webhook path that tags new Tines cases on creation, and a batch mode to tag existing cases. Validate technique IDs against the ATT&CK catalog, avoid duplicate tags, and handle alerts with no clear mapping. Output the applied tags per case.
What this prompt builds
Generate and apply MITRE ATT&CK technique and tactic tags to new and existing security cases.
The problem
Cases rarely get consistently mapped to MITRE ATT&CK because tagging is manual and subjective, undermining coverage analysis and reporting. Without it, teams can't see which techniques they're blind to.
Solution and impact
This workflow generates ATT&CK technique and tactic tags for alerts via Send-to-Story and applies them to new cases by webhook or to existing cases in bulk. Cases get consistent ATT&CK mapping that powers coverage metrics and reporting.