Docs

SOC Response Atlas has no backend and no database. Every technique's data is generated at build time from a YAML source pack into plain static JSON and Markdown files under /api. The frontend calls the exact same files an external caller can curl directly.

Available files, per technique

/api/index.json — list of every technique with a recommendation pack
/api/matrix-enterprise.json — the full 15-tactic ATT&CK matrix with coverage status
/api/search-index.json — flattened technique list used to power client-side search
/api/techniques/{id}.json — technique metadata (name, tactics, platforms, summary)
/api/recommendations/{id}.json — the full SOC response pack
/api/d3fend/{id}.json — D3FEND defensive mappings only
/api/mappings/{id}.json — ATT&CK → D3FEND → SOC action mapping table
/api/confluence/{id}.md — Confluence-ready runbook Markdown

Example

curl https://atlas.basyrix.com/api/recommendations/T1078.json
curl https://atlas.basyrix.com/api/confluence/T1078.md

Using the Confluence export

Each technique's Confluence Export tab has Copy / View / Download buttons for the generated Markdown. Paste it into a Confluence page — headings, tables, and the KQL code block carry over cleanly. Basyrix Pro will later push and update the page directly via the Confluence API instead of copy/paste.

What's covered right now

The matrix is the real MITRE ATT&CK Enterprise catalog -- all 15 tactics, 222 top-level techniques, imported directly from MITRE's own STIX data (scripts/import-mitre.ts). Every technique has a recommendation pack, but at two honest depths, shown as different tile colors:

Purple (66 techniques) -- real investigation steps and response actions: the original 10 hand-authored flagship packs, plus 56 more where a fully-documented rule from a private baseline detection-rules library matched the technique and was used directly.
Amber (156 techniques) -- generated: real MITRE description as the summary, real D3FEND mapping(s) fetched live per technique, but templated investigation steps and escalation criteria rather than documented ones.

KQL/ES|QL isn't gated behind that split: 157 packs have real Sentinel detection rules and 161 have real Elastic detection rules (from Bell Integration's own baseline library, Microsoft's official Azure-Sentinel Detections, and Elastic's official detection-rules repo), spanning both purple and amber tiers. 38 techniques had no real match in either source and kept a generic placeholder query.

Basyrix SecOps Platform (paid, later)

Live Sentinel/Defender XDR enrichment, direct Confluence push, ServiceNow ticket generation, Torq SOAR workflow integration, MISP/Cyble threat intel, Fortra vulnerability context, tenant-aware private recommendation packs, team workspaces, and response coverage dashboards. The free map here stays free — the paid platform adds live context, automation, and scale on top of it.