ThreatFilter — ATT&CK triage worksheet
Guide: https://threatfilter.dev/guides/attack-group-triage/
Keep completed copies in your approved internal case system.

Group name, alias and MITRE identifier:
ATT&CK dataset version / research date:
Technique / sub-technique and reported procedure:
Original reference and observation period:
Investigation question and hypothesis:
Relevant assets / platforms:
Required telemetry and retention gaps:
Search period, timezone and query:
Observed evidence identifiers:
Legitimate alternatives and differences from the report:
Outcome, uncertainty and next action:
Reviewer:

Technique overlap is not actor attribution. A layer is not a detection coverage score.