Docs

SOC Response Atlas has no backend and no database. Every technique's data is generated at build time from a YAML source pack into plain static JSON and Markdown files under /api. The frontend calls the exact same files an external caller can curl directly.

Available files, per technique

/api/index.json — list of every technique with a recommendation pack
/api/matrix-enterprise.json — the full 15-tactic ATT&CK matrix with coverage status
/api/search-index.json — flattened technique list used to power client-side search
/api/techniques/{id}.json — technique metadata (name, tactics, platforms, summary)
/api/recommendations/{id}.json — the full SOC response pack
/api/d3fend/{id}.json — D3FEND defensive mappings only
/api/mappings/{id}.json — ATT&CK → D3FEND → SOC action mapping table
/api/confluence/{id}.md — Confluence-ready runbook Markdown

Example

curl https://atlas.basyrix.com/api/recommendations/T1078.json
curl https://atlas.basyrix.com/api/confluence/T1078.md

Using the Confluence export

Each technique's Confluence Export tab has Copy / View / Download buttons for the generated Markdown. Paste it into a Confluence page — headings, tables, and the KQL code block carry over cleanly. Basyrix Pro will later push and update the page directly via the Confluence API instead of copy/paste.

What's covered right now

The matrix is the real MITRE ATT&CK Enterprise catalog -- all 15 tactics, 222 top-level techniques, imported directly from MITRE's own STIX data (scripts/import-mitre.ts). Every technique has a recommendation pack, but at two honest depths, shown as different tile colors:

Purple (10 techniques) -- hand-authored: T1078, T1110, T1059, T1566, T1098, T1114, T1685, T1003, T1021, T1486. Investigation steps, KQL, and escalation criteria tuned per technique.
Amber (212 techniques) -- generated: real MITRE description as the summary, real D3FEND mapping(s) fetched live per technique, but templated operational sections rather than hand-tuned ones.

Basyrix SecOps Platform (paid, later)

Live Sentinel/Defender XDR enrichment, direct Confluence push, ServiceNow ticket generation, Torq SOAR workflow integration, MISP/Cyble threat intel, Fortra vulnerability context, tenant-aware private recommendation packs, team workspaces, and response coverage dashboards. The free map here stays free — the paid platform adds live context, automation, and scale on top of it.