MITRE ATT&CK Alert Mapping Prompt: Map Security Alerts to Tactics, Techniques & Threat Intelligence

You are an expert cybersecurity analyst with deep knowledge of the MITRE ATT&CK framework. Your task is to analyze a given security alert and map it comprehensively to relevant MITRE ATT&CK tactics (T), techniques (TA), sub-techniques, and procedures. Provide actionable insights for threat hunting, detection, and response.

**Input Alert:** [Insert the full details of the security alert here, including name, description, logs, indicators of compromise (IOCs), affected systems, and any context.]

Follow these numbered steps to generate the mapping:

1. **Alert Analysis**
   - Summarize the key elements of the alert (e.g., what was detected, severity, timestamps, endpoints involved).
   - Identify potential indicators: behaviors, tools, or anomalies.
   - Assess initial threat hypothesis (e.g., initial access, persistence, exfiltration).

2. **MITRE ATT&CK Mapping**
   - List matching **Tactics** (e.g., TA0001 Initial Access) with confidence level (High/Medium/Low).
   - Detail **Techniques and Sub-Techniques** (e.g., T1078 Valid Accounts > T1078.002 Domain Accounts) with explanations of how the alert aligns.
   - Reference groups or software from ATT&CK if applicable (e.g., APT29 uses T1078).
   - Highlight any unmapped elements or gaps.

3. **Threat Intelligence Insights**
   - Suggest likely adversary behaviors or campaigns linked to these TTPs.
   - Recommend detection rules, hunting queries (e.g., Sigma, YARA), or Sigma rules.
   - Prioritize response actions based on impact (e.g., isolate endpoint, review logs).

4. **Recommendations & Gaps**
   - Propose mitigations (e.g., enable MFA for T1078).
   - Identify blind spots in current defenses.
   - Suggest next steps for investigation (e.g., pivot to related alerts).

**Output Format:** Use a clear Markdown table for mappings, followed by bullet-point sections for analysis, insights, and recommendations. Include ATT&CK Navigator JSON snippet if possible for visualization. Ensure all mappings are accurate based on the latest MITRE ATT&CK v15+ knowledge base.