{
  "name": "Pulse CA - ATT&CK mapping",
  "versions": {
    "attack": "19",
    "navigator": "5.0.0",
    "layer": "4.5"
  },
  "domain": "enterprise-attack",
  "description": "AffirmedID's own mapping of Pulse CA controls to MITRE ATT&CK techniques. Mapping v1.0, 2026-10. Designed and implemented; in integration and deployment testing. Adversarial validation planned. Not reviewed or endorsed by MITRE.",
  "filters": {
    "platforms": [
      "Windows",
      "macOS",
      "Linux",
      "SaaS",
      "Identity Provider",
      "Office Suite"
    ]
  },
  "layout": {
    "layout": "side",
    "showName": true,
    "showID": true,
    "expandedSubtechniques": "annotated"
  },
  "hideDisabled": false,
  "techniques": [
    {
      "techniqueID": "T1550.001",
      "color": "#0066cc",
      "comment": "Pulse CA mapping: Replay of stolen access tokens and session cookies. Designed and implemented; in integration and deployment testing. Adversarial validation planned.",
      "enabled": true,
      "showSubtechniques": true,
      "metadata": [
        {
          "name": "Status",
          "value": "Designed and implemented; in integration and deployment testing. Adversarial validation planned."
        },
        {
          "name": "Detail",
          "value": "https://affirmedidentity.com/attack-mapping#token-replay"
        }
      ],
      "links": [
        {
          "label": "Pulse CA mapping",
          "url": "https://affirmedidentity.com/attack-mapping#token-replay"
        }
      ]
    },
    {
      "techniqueID": "T1550.004",
      "color": "#0066cc",
      "comment": "Pulse CA mapping: Replay of stolen access tokens and session cookies. Designed and implemented; in integration and deployment testing. Adversarial validation planned.",
      "enabled": true,
      "showSubtechniques": true,
      "metadata": [
        {
          "name": "Status",
          "value": "Designed and implemented; in integration and deployment testing. Adversarial validation planned."
        },
        {
          "name": "Detail",
          "value": "https://affirmedidentity.com/attack-mapping#token-replay"
        }
      ],
      "links": [
        {
          "label": "Pulse CA mapping",
          "url": "https://affirmedidentity.com/attack-mapping#token-replay"
        }
      ]
    },
    {
      "techniqueID": "T1528",
      "color": "#8fb8e6",
      "comment": "Related precursor to T1550.001, T1550.004. Designed and implemented; in integration and deployment testing. Adversarial validation planned.",
      "enabled": true,
      "showSubtechniques": true,
      "metadata": [
        {
          "name": "Status",
          "value": "Designed and implemented; in integration and deployment testing. Adversarial validation planned."
        },
        {
          "name": "Detail",
          "value": "https://affirmedidentity.com/attack-mapping#token-replay"
        }
      ],
      "links": [
        {
          "label": "Pulse CA mapping",
          "url": "https://affirmedidentity.com/attack-mapping#token-replay"
        }
      ]
    },
    {
      "techniqueID": "T1539",
      "color": "#8fb8e6",
      "comment": "Related precursor to T1550.001, T1550.004. Designed and implemented; in integration and deployment testing. Adversarial validation planned.",
      "enabled": true,
      "showSubtechniques": true,
      "metadata": [
        {
          "name": "Status",
          "value": "Designed and implemented; in integration and deployment testing. Adversarial validation planned."
        },
        {
          "name": "Detail",
          "value": "https://affirmedidentity.com/attack-mapping#token-replay"
        }
      ],
      "links": [
        {
          "label": "Pulse CA mapping",
          "url": "https://affirmedidentity.com/attack-mapping#token-replay"
        }
      ]
    },
    {
      "techniqueID": "T1566",
      "color": "#0066cc",
      "comment": "Pulse CA mapping: Phishing for credentials, sessions and tokens. Designed and implemented; in integration and deployment testing. Adversarial validation planned.",
      "enabled": true,
      "showSubtechniques": true,
      "metadata": [
        {
          "name": "Status",
          "value": "Designed and implemented; in integration and deployment testing. Adversarial validation planned."
        },
        {
          "name": "Detail",
          "value": "https://affirmedidentity.com/attack-mapping#phishing"
        }
      ],
      "links": [
        {
          "label": "Pulse CA mapping",
          "url": "https://affirmedidentity.com/attack-mapping#phishing"
        }
      ]
    },
    {
      "techniqueID": "T1566.001",
      "color": "#0066cc",
      "comment": "Pulse CA mapping: Phishing for credentials, sessions and tokens. Designed and implemented; in integration and deployment testing. Adversarial validation planned.",
      "enabled": true,
      "showSubtechniques": true,
      "metadata": [
        {
          "name": "Status",
          "value": "Designed and implemented; in integration and deployment testing. Adversarial validation planned."
        },
        {
          "name": "Detail",
          "value": "https://affirmedidentity.com/attack-mapping#phishing"
        }
      ],
      "links": [
        {
          "label": "Pulse CA mapping",
          "url": "https://affirmedidentity.com/attack-mapping#phishing"
        }
      ]
    },
    {
      "techniqueID": "T1566.002",
      "color": "#0066cc",
      "comment": "Pulse CA mapping: Phishing for credentials, sessions and tokens. Designed and implemented; in integration and deployment testing. Adversarial validation planned.",
      "enabled": true,
      "showSubtechniques": true,
      "metadata": [
        {
          "name": "Status",
          "value": "Designed and implemented; in integration and deployment testing. Adversarial validation planned."
        },
        {
          "name": "Detail",
          "value": "https://affirmedidentity.com/attack-mapping#phishing"
        }
      ],
      "links": [
        {
          "label": "Pulse CA mapping",
          "url": "https://affirmedidentity.com/attack-mapping#phishing"
        }
      ]
    },
    {
      "techniqueID": "T1566.003",
      "color": "#0066cc",
      "comment": "Pulse CA mapping: Phishing for credentials, sessions and tokens. Designed and implemented; in integration and deployment testing. Adversarial validation planned.",
      "enabled": true,
      "showSubtechniques": true,
      "metadata": [
        {
          "name": "Status",
          "value": "Designed and implemented; in integration and deployment testing. Adversarial validation planned."
        },
        {
          "name": "Detail",
          "value": "https://affirmedidentity.com/attack-mapping#phishing"
        }
      ],
      "links": [
        {
          "label": "Pulse CA mapping",
          "url": "https://affirmedidentity.com/attack-mapping#phishing"
        }
      ]
    },
    {
      "techniqueID": "T1566.004",
      "color": "#0066cc",
      "comment": "Pulse CA mapping: Phishing for credentials, sessions and tokens. Designed and implemented; in integration and deployment testing. Adversarial validation planned.",
      "enabled": true,
      "showSubtechniques": true,
      "metadata": [
        {
          "name": "Status",
          "value": "Designed and implemented; in integration and deployment testing. Adversarial validation planned."
        },
        {
          "name": "Detail",
          "value": "https://affirmedidentity.com/attack-mapping#phishing"
        }
      ],
      "links": [
        {
          "label": "Pulse CA mapping",
          "url": "https://affirmedidentity.com/attack-mapping#phishing"
        }
      ]
    }
  ],
  "legendItems": [
    {
      "label": "Mapped (designed & implemented, in testing)",
      "color": "#0066cc"
    },
    {
      "label": "Related precursor technique",
      "color": "#8fb8e6"
    }
  ],
  "showTacticRowBackground": false,
  "selectTechniquesAcrossTactics": true,
  "selectSubtechniquesWithParent": false,
  "links": [
    {
      "label": "Pulse CA ATT&CK mapping",
      "url": "https://affirmedidentity.com/attack-mapping"
    }
  ],
  "metadata": [
    {
      "name": "Publisher",
      "value": "AffirmedID"
    }
  ]
}