ATTCK2FHIR Implementation Guide - Local Development build (v0.0.5) built by the FHIR (HL7® FHIR® Standard) Build Tools. See the Directory of published versions

Home

Official URL: https://constir1.github.io/ATTCK2FHIR/ImplementationGuide/fhir.attck				Version: 0.0.5	Highlight text changes?
Draft as of 2026-04-26					Computable Name: AttCKIG

ATT&CK2FHIR Implementation Guide

This Implementation Guide defines FHIR representations of the MITRE ATT&CK® Enterprise framework, focusing on Tactics, Techniques, and Sub-Techniques. It publishes a FHIR CodeSystem that encodes ATT&CK concepts with tactic membership and parent-technique relationships expressed as coded properties, enabling ATT&CK to be referenced in FHIR-native clinical and security workflows. The primary use case is profiling the FHIR AuditEvent resource to document detected adversarial behaviors, such as those observed in FHIR honeypot deployments, using standardized, interoperable terminology.

This implementation guide reproduces MITRE ATT&CK® data. © 2025 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark of The MITRE Corporation. Data is provided "as is" without warranties of any kind. See the full ATT&CK Terms of Use.