What the catalogue contains
Loading the catalogue…
How to read these counts
They describe curation: which public documents were read and which CloudTrail API calls were taken from them. They do not say how often attackers use a call, how risky it is, or how well it can be detected. The data has no dates, so nothing here is a trend. AI-suggested ATT&CK techniques are never used.
Every number opens exactly the events behind it in the event table.
Start here
Incident sources
events from this source mapped to that tactic. Click a column header to sort.
Sources with a single catalogued event
Each row is a document TrailDiscover cites as incident evidence, not an intrusion. Rows include single-incident write-ups, multi-case roundups, conference talks, legal filings, news and tweets, and one intrusion can appear in several rows.
A row lists only the calls curators catalogued from that document, so its size reflects how many calls the document names and how deeply it was read, not severity. Tactics use TrailDiscover's per-event mapping: an event mapped to two or three tactics counts in each, so a row's cells can add up to more than its event count. Columns follow ATT&CK order, not time.
ATT&CK techniques in the catalogue
A presence-only layer: every technique a catalogued call maps to, without scores.
Loading the ATT&CK index…
Each row counts the CloudTrail API calls TrailDiscover has catalogued and mapped to the technique under that tactic, placed only where ATT&CK itself lists the technique. That is documented API surface, not how often attackers use a technique, how risky it is, or how well it can be detected. Discovery is large because every Describe or List call is its own entry, and a call mapped to several techniques or tactics appears in each.
AWS services by ATT&CK tactic
catalogued events of this service mapped to that tactic. Click a column header to sort.
Counts are events catalogued in TrailDiscover, not how often an API is abused or how risky a service is. A blank cell means nothing is catalogued for that pair yet. "Incident sources" counts the distinct public documents linked to any of the service's events; some are roundups or talks, and several can describe the same actor. "In the wild" is a curator judgement.