IP Review

Unattributed Code Systems

Copyright Fragment

This fragment is not visible to the reader

No use of external IP (other than from the FHIR specification)

Copyright and Registered Trademark Uses

IG © 2026+ ATTCK2FHIR IG. Package fhir.attck#0.0.5 based on FHIR 4.0.1. Generated 2026-04-26 Links: Table of Contents | QA Report ( src )
hl7.fhir.us.hai: Healthcare Associated Infection Implementation Guide ®© HL7 | CC0 ( src )
ATTCK2FHIR Implementation Guide - Local Development build (v0.0.5) built by the FHIR (HL7® FHIR® Standard) Build Tools. See the Directory of published versions ( src )
This Implementation Guide defines FHIR representations of the MITRE ATT&CK® Enterprise framework, focusing on Tactics, Techniques, and Sub-Techniques. It publishes a FHIR CodeSystem that encodes ATT&CK concepts with tactic membership and parent-technique relationships expressed as coded properties, enabling ATT&CK to be referenced in FHIR-native clinical and security workflows. The primary use case is profiling the FHIR AuditEvent resource to document detected adversarial behaviors, such as those observed in FHIR honeypot deployments, using standardized, interoperable terminology. ( src )
This implementation guide reproduces MITRE ATT&CK® data. © 2025 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark of The MITRE Corporation. Data is provided "as is" without warranties of any kind. See the full ATT&CK Terms of Use. ( src )

External References

Type Reference Content

web example.org More specific type/id for the event
Binding: http://example.org/fsh/ValueSet/MITRE-ATTCK-Techniques ( required )

web example.org The purposeOfUse of the event
Binding: http://example.org/fsh/ValueSet/MITRE-ATTCK-Tactics ( extensible )

web constir1.github.io IG © 2026+ ATTCK2FHIR IG . Package fhir.attck#0.0.5 based on FHIR 4.0.1 . Generated 2026-04-26
Links: Table of Contents | QA Report

web example.org The codes SHALL be taken from Unless not suitable, these codes SHALL be taken from http://example.org/fsh/ValueSet/MITRE-ATTCK-Techniques http://hl7.org/fhir/ValueSet/audit-event-sub-type|4.0.1
( required to http://example.org/fsh/ValueSet/MITRE-ATTCK-Techniques )

web example.org Unless not suitable, these codes SHALL be taken from http://example.org/fsh/ValueSet/MITRE-ATTCK-Tactics http://terminology.hl7.org/ValueSet/v3-PurposeOfUse
( extensible to http://example.org/fsh/ValueSet/MITRE-ATTCK-Tactics )

web example.org The codes SHALL be taken from http://example.org/fsh/ValueSet/MITRE-ATTCK-Techniques
( required to http://example.org/fsh/ValueSet/MITRE-ATTCK-Techniques )

web example.org Unless not suitable, these codes SHALL be taken from http://example.org/fsh/ValueSet/MITRE-ATTCK-Tactics
( extensible to http://example.org/fsh/ValueSet/MITRE-ATTCK-Tactics )

web example.org http://example.org/fsh/ValueSet/MITRE-ATTCK-Techniques

web example.org http://example.org/fsh/ValueSet/MITRE-ATTCK-Tactics

web attack.mitre.org This implementation guide reproduces MITRE ATT&CK® data. © 2025 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark of The MITRE Corporation. Data is provided "as is" without warranties of any kind. See the full ATT&CK Terms of Use .

Type	Reference	Content
web	example.org	More specific type/id for the event Binding: http://example.org/fsh/ValueSet/MITRE-ATTCK-Techniques ( required )
web	example.org	The purposeOfUse of the event Binding: http://example.org/fsh/ValueSet/MITRE-ATTCK-Tactics ( extensible )
web	constir1.github.io	IG © 2026+ ATTCK2FHIR IG . Package fhir.attck#0.0.5 based on FHIR 4.0.1 . Generated 2026-04-26 Links: Table of Contents \| QA Report
web	example.org	The codes SHALL be taken from Unless not suitable, these codes SHALL be taken from http://example.org/fsh/ValueSet/MITRE-ATTCK-Techniques http://hl7.org/fhir/ValueSet/audit-event-sub-type\|4.0.1 ( required to `http://example.org/fsh/ValueSet/MITRE-ATTCK-Techniques` )
web	example.org	Unless not suitable, these codes SHALL be taken from http://example.org/fsh/ValueSet/MITRE-ATTCK-Tactics http://terminology.hl7.org/ValueSet/v3-PurposeOfUse ( extensible to `http://example.org/fsh/ValueSet/MITRE-ATTCK-Tactics` )
web	example.org	The codes SHALL be taken from http://example.org/fsh/ValueSet/MITRE-ATTCK-Techniques ( required to `http://example.org/fsh/ValueSet/MITRE-ATTCK-Techniques` )
web	example.org	Unless not suitable, these codes SHALL be taken from http://example.org/fsh/ValueSet/MITRE-ATTCK-Tactics ( extensible to `http://example.org/fsh/ValueSet/MITRE-ATTCK-Tactics` )
web	example.org	http://example.org/fsh/ValueSet/MITRE-ATTCK-Techniques
web	example.org	http://example.org/fsh/ValueSet/MITRE-ATTCK-Tactics
web	attack.mitre.org	This implementation guide reproduces MITRE ATT&CK® data. © 2025 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark of The MITRE Corporation. Data is provided "as is" without warranties of any kind. See the full ATT&CK Terms of Use .

Internal Images

tree-filter.png