Changes to security posture are then conducted in the security tools providing their log data, (i.e., EDR or CASB). Using MITRE ATT&CK with EDR involves mapping events observed by the endpoint agent, allowing defenders to determine the phases of a threat event, assess associated risk, and ...