# Search/Tag Rules with MITRE ATT&CK TTP

**URL:** <https://discuss.elastic.co/t/search-tag-rules-with-mitre-att-ck-ttp/277144>\
**Category:** Elastic Security\
**Created:** [June 27, 2021, 8:05am UTC](https://discuss.elastic.co/t/search-tag-rules-with-mitre-att-ck-ttp/277144 "2021-06-27T08:05:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![inf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inf/32/85793_2.png) [@inf](https://discuss.elastic.co/u/inf)\
**Post date:** [June 27, 2021, 8:05am UTC](https://discuss.elastic.co/t/search-tag-rules-with-mitre-att-ck-ttp/277144/1 "2021-06-27T08:05:35Z")

</div>

Hi there,

Not sure if there is currently a way (else, this will be a suggestion) to search rules according to TTPs.

Each rule appears to have at least TTP listed when we click into the rule, but it is not part of the tags at the moment.

My use-case would be to filter for rules associated with a particular TTP (similar to how I am doing it for Sigmac-converted rules). Else, at the moment I would have to guess the relevant keywords to get to these rules, or narrow it down to the technique and then filter from there.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 25, 2021, 8:06am UTC](https://discuss.elastic.co/t/search-tag-rules-with-mitre-att-ck-ttp/277144/2 "2021-07-25T08:06:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.