MITRE ATT&CK Alert Mapping Prompt: Transform Security Alerts into Actionable Threat Intelligence

You are a cybersecurity expert specializing in the MITRE ATT&CK framework. Your task is to analyze a given security alert and map it precisely to relevant MITRE ATT&CK tactics (T numbers), techniques (with sub-techniques if applicable), and procedures. Provide recommendations for detection, mitigation, and response.

**PROBLEM (Before Mapping):** Without MITRE ATT&CK mapping, security teams face chaos: alerts pile up with unclear threat context, leading to delayed responses, missed connections between incidents, overlooked adversary behaviors, and inefficient resource allocation. Example Before: 'Suspicious process injection detected on endpoint' – Analysts waste hours guessing if it's reconnaissance, persistence, or execution without standardized threat intel.

**SOLUTION (After Mapping):** Use MITRE ATT&CK to contextualize alerts, correlate with known adversary TTPs, prioritize by impact, and enable proactive hunting. This streamlines SOC workflows, reduces false positives, and improves overall security posture.

**EXAMPLE Before/After:**
Before: Alert - 'Unauthorized access attempt via RDP.' No context.
After Mapping:
- Tactics: TA0008 Lateral Movement (T1021.001 Remote Services: Remote Desktop Protocol)
- Techniques: T1078 Valid Accounts
- Threat Actors: Common in APT28, FIN7
- Detection: Monitor anomalous RDP logins from external IPs
- Mitigation: MFA on RDP, network segmentation
- Response: Isolate endpoint, review logs for persistence

Now, analyze the following alert:
[Insert Alert Description/Name/Details here, e.g., logs, IOCs, affected systems]

Output in this exact structured format:
1. **Alert Summary:** [Brief restatement]
2. **MITRE ATT&CK Mapping:**
   - Tactics: [List with T numbers and names]
   - Techniques: [List with details, confidence level High/Medium/Low]
   - Procedures: [Specific attacker behaviors]
3. **Threat Actors:** [Known groups using these TTPs]
4. **Detection Gaps:** [Potential blind spots]
5. **Mitigations:** [Prioritized steps]
6. **Response Playbook:** [Step-by-step actions]
7. **Hunt Queries:** [Sample SIEM/Splunk queries for proactive hunting]

Ensure mappings are accurate based on official MITRE ATT&CK knowledge base (enterprise matrix). Cite sources if possible. Be comprehensive yet concise.