ATTCK2FHIR Implementation Guide
0.0.5 - ci-build

ATTCK2FHIR Implementation Guide - Local Development build (v0.0.5) built by the FHIR (HL7® FHIR® Standard) Build Tools. See the Directory of published versions

: CS MITRE ATT&CK Tactics

Draft as of 2026-04-26

Raw ttl | Download


@prefix fhir: <http://hl7.org/fhir/> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .

# - resource -------------------------------------------------------------------

 a fhir:CodeSystem ;
  fhir:nodeRole fhir:treeRoot ;
  fhir:id [ fhir:v "MITRE-ATTCK-Tactics"] ; # 
  fhir:language [ fhir:v "en"] ; # 
  fhir:text [
fhir:status [ fhir:v "generated" ] ;
fhir:div [ fhir:v "<div xmlns=\"http://www.w3.org/1999/xhtml\"><p class=\"res-header-id\"><b>Generated Narrative: CodeSystem MITRE-ATTCK-Tactics</b></p><a name=\"MITRE-ATTCK-Tactics\"> </a><a name=\"hcMITRE-ATTCK-Tactics\"> </a><p>This case-sensitive code system <code>https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Tactics</code> defines the following codes:</p><table class=\"codes\"><tr><td style=\"white-space:nowrap\"><b>Code</b></td><td><b>Display</b></td></tr><tr><td style=\"white-space:nowrap\">TA0006<a name=\"MITRE-ATTCK-Tactics-TA0006\"> </a></td><td>Credential Access</td></tr><tr><td style=\"white-space:nowrap\">TA0002<a name=\"MITRE-ATTCK-Tactics-TA0002\"> </a></td><td>Execution</td></tr><tr><td style=\"white-space:nowrap\">TA0040<a name=\"MITRE-ATTCK-Tactics-TA0040\"> </a></td><td>Impact</td></tr><tr><td style=\"white-space:nowrap\">TA0003<a name=\"MITRE-ATTCK-Tactics-TA0003\"> </a></td><td>Persistence</td></tr><tr><td style=\"white-space:nowrap\">TA0004<a name=\"MITRE-ATTCK-Tactics-TA0004\"> </a></td><td>Privilege Escalation</td></tr><tr><td style=\"white-space:nowrap\">TA0008<a name=\"MITRE-ATTCK-Tactics-TA0008\"> </a></td><td>Lateral Movement</td></tr><tr><td style=\"white-space:nowrap\">TA0005<a name=\"MITRE-ATTCK-Tactics-TA0005\"> </a></td><td>Defense Evasion</td></tr><tr><td style=\"white-space:nowrap\">TA0010<a name=\"MITRE-ATTCK-Tactics-TA0010\"> </a></td><td>Exfiltration</td></tr><tr><td style=\"white-space:nowrap\">TA0007<a name=\"MITRE-ATTCK-Tactics-TA0007\"> </a></td><td>Discovery</td></tr><tr><td style=\"white-space:nowrap\">TA0009<a name=\"MITRE-ATTCK-Tactics-TA0009\"> </a></td><td>Collection</td></tr><tr><td style=\"white-space:nowrap\">TA0042<a name=\"MITRE-ATTCK-Tactics-TA0042\"> </a></td><td>Resource Development</td></tr><tr><td style=\"white-space:nowrap\">TA0043<a name=\"MITRE-ATTCK-Tactics-TA0043\"> </a></td><td>Reconnaissance</td></tr><tr><td style=\"white-space:nowrap\">TA0011<a name=\"MITRE-ATTCK-Tactics-TA0011\"> </a></td><td>Command and Control</td></tr><tr><td style=\"white-space:nowrap\">TA0001<a name=\"MITRE-ATTCK-Tactics-TA0001\"> </a></td><td>Initial Access</td></tr></table></div>"^^rdf:XMLLiteral ]
  ] ; # 
  fhir:url [
fhir:v "https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Tactics"^^xsd:anyURI ;
fhir:l <https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Tactics>
  ] ; # 
  fhir:version [ fhir:v "0.0.5"] ; # 
  fhir:name [ fhir:v "MITRE-ATTCK-Tactics"] ; # 
  fhir:title [ fhir:v "CS MITRE ATT&CK Tactics"] ; # 
  fhir:status [ fhir:v "draft"] ; # 
  fhir:experimental [ fhir:v false] ; # 
  fhir:date [ fhir:v "2026-04-26T20:36:59+00:00"^^xsd:dateTime] ; # 
  fhir:publisher [ fhir:v "ATTCK2FHIR IG"] ; # 
  fhir:contact ( [
fhir:name [ fhir:v "ATTCK2FHIR IG" ] ;
    ( fhir:telecom [
fhir:system [ fhir:v "url" ] ;
fhir:value [ fhir:v "https://constir1.github.io/ATTCK2FHIR" ]     ] )
  ] ) ; # 
  fhir:description [ fhir:v "This Code System contains all MITRE ATT&CK Enterprise Tactics"] ; # 
  fhir:caseSensitive [ fhir:v true] ; # 
  fhir:content [ fhir:v "complete"] ; # 
  fhir:count [ fhir:v "14"^^xsd:nonNegativeInteger] ; # 
  fhir:concept ( [
fhir:code [ fhir:v "TA0006" ] ;
fhir:display [ fhir:v "Credential Access" ]
  ] [
fhir:code [ fhir:v "TA0002" ] ;
fhir:display [ fhir:v "Execution" ]
  ] [
fhir:code [ fhir:v "TA0040" ] ;
fhir:display [ fhir:v "Impact" ]
  ] [
fhir:code [ fhir:v "TA0003" ] ;
fhir:display [ fhir:v "Persistence" ]
  ] [
fhir:code [ fhir:v "TA0004" ] ;
fhir:display [ fhir:v "Privilege Escalation" ]
  ] [
fhir:code [ fhir:v "TA0008" ] ;
fhir:display [ fhir:v "Lateral Movement" ]
  ] [
fhir:code [ fhir:v "TA0005" ] ;
fhir:display [ fhir:v "Defense Evasion" ]
  ] [
fhir:code [ fhir:v "TA0010" ] ;
fhir:display [ fhir:v "Exfiltration" ]
  ] [
fhir:code [ fhir:v "TA0007" ] ;
fhir:display [ fhir:v "Discovery" ]
  ] [
fhir:code [ fhir:v "TA0009" ] ;
fhir:display [ fhir:v "Collection" ]
  ] [
fhir:code [ fhir:v "TA0042" ] ;
fhir:display [ fhir:v "Resource Development" ]
  ] [
fhir:code [ fhir:v "TA0043" ] ;
fhir:display [ fhir:v "Reconnaissance" ]
  ] [
fhir:code [ fhir:v "TA0011" ] ;
fhir:display [ fhir:v "Command and Control" ]
  ] [
fhir:code [ fhir:v "TA0001" ] ;
fhir:display [ fhir:v "Initial Access" ]
  ] ) . #