AI-Assisted Secure Coding (Appendix C) · Adversarial AI Detection in Inbound Contributions
Map detections to MITRE ATT&CK and ATLAS
Verify that detection rules are tagged to MITRE ATT&CK (T1195 Supply Chain Compromise and CI/CD-relevant sub-techniques) and to MITRE ATLAS techniques, maintained for the inbound contribution analysis use case, and reviewed against current threat intelligence.
OWASP AISVS v1.01, requirement AC.13.4
In plain English
Tag your detection rules with the matching MITRE ATT&CK and MITRE ATLAS techniques, maintain them for inbound contribution analysis, and review them against current threat intelligence. The tags show which techniques you cover, and where you have nothing.
What good looks like
- Rules are mapped to ATT&CK, including T1195 Supply Chain Compromise and the CI/CD-relevant sub-techniques, and to ATLAS techniques.
- The rule set is maintained for the inbound-contribution use case and has an owner.
- Reviews against current threat intelligence happen on a schedule and are recorded.
- A coverage view shows techniques with no rule.
How teams usually do it
- Technique tags as metadata in the rule repository (Sigma rules support this directly).
- A coverage matrix built from the tags, for example with ATT&CK Navigator.
- A review after each notable public supply-chain or CI/CD incident.
Suggested evidence
- Tagged rules.
- The coverage matrix.
- Review records.
Common mistakes
- Tagging once and never revisiting.
- Tagging rules to look thorough when the rules have never fired in a test.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.