05-14-2026 09:46 AM - edited 05-14-2026 09:51 AM
Hey LIVEcommunity,
I have been sitting on this for a while and finally decided to write it up because I am pretty sure I am not the only one running into this. If you are a detection engineer or SOC analyst building BIOCs in Cortex XDR and leaning on MITRE ATT&CK to organize your detection coverage, this one is for you.
A few months back, I reached out to Palo Alto support with a question about which version of MITRE ATT&CK was mapped into Cortex XDR. The answer I got was v16 (that is the October 2024 release), and I was told there was a roadmap to bring it up to v17.
Fair enough. These things take time. I get it.
Fast forward to today. MITRE has since shipped v17, v18, and v19. That latest one dropped on April 28, 2026, and it was not a minor bump. I have been watching the BIOC rule creation workflow closely, and as far as I can tell, nothing has changed. The Tactic and Technique dropdowns still look like v16 to me. The BIOC rule TYPE field in the documentation still lists "Evasion" as a category, which is a dead giveaway that v19 has not landed yet.
So that roadmap to v17? I am not sure what happened to it, but we are now three versions behind and counting.
For reference, here is my current environment so there is no ambiguity about what I am looking at:
Environment Details
| Component | Version / Detail |
|---|---|
| Cortex XDR | v5.0 |
| UI Version | master-platform-v5.0.0 |
| UI Build Time | Feb 16, 2026 |
| Server Version | master-platform-v4.4.0 |
| Server Build Time | Feb 6, 2026 |
| Deployment Time | Feb 8, 2026 |
| Automation Version | 8.13.0 |
| XQL Content Version | master-platform-v4.4.0-146 |
| XDM Content Version | master-platform-v4.4.0-111 |
| Content Version | 2250-35893 |
| WildFire Server | wildfire.paloaltonetworks.com |
If anyone from Palo Alto engineering needs additional build details to investigate, I am happy to provide them privately.
Normally I would not make a big deal about being a version or two behind. Frameworks evolve, vendors catch up, life goes on. But v19 is different. MITRE fundamentally restructured the Enterprise matrix this time, and it changes how we think about and classify adversary behavior:
Defense Evasion is gone. That tactic we have all been mapping to for years (TA0005) has been split into two distinct tactics:
That is a meaningful distinction. "Hiding from your tools" and "breaking your tools" are fundamentally different adversary behaviors that warrant different detection strategies, different response playbooks, and different risk conversations with leadership.
Beyond that, v19 brought the Enterprise matrix to 15 Tactics, 222 Techniques, and 475 Sub-Techniques. ICS ATT&CK got sub-techniques for the first time. T1562 (Impair Defenses) was restructured into T1685 (Disable or Modify Tools) and related techniques. There are new techniques covering AI-orchestrated espionage, social engineering aimed at impairing defenses, and cross-domain wipers. This was a big release.
And right now, none of that is available to me when I am building detections in XDR.
Here is where I went from "mildly annoyed" to "I need to write a forum post about this."
Palo Alto's own Unit 42 team is publishing Managed Threat Hunting reports that reference v19 tactics and techniques. I am literally receiving threat intelligence from Palo Alto that is mapped to a framework version that Palo Alto's own detection platform does not support.
So the workflow looks like this:
Neither of those options is great. And for those of us who use ATT&CK coverage maps to identify detection gaps, report to leadership, or meet compliance requirements, inaccurate mappings are not just an annoyance. They erode the foundation of the whole threat-informed defense approach.
It feels like the left hand and the right hand are not talking to each other here.
I am not here to bash Palo Alto. I genuinely like Cortex XDR and I think the platform does a lot of things well. But I do think this deserves some attention, and I have a few straightforward questions:
What version of MITRE ATT&CK is Cortex XDR currently aligned to? Is it actually documented anywhere? I have not been able to find a definitive answer outside of asking support directly.
What happened to the v17 roadmap, and what is the updated timeline? If the plan has shifted to go straight to v19, great. But some transparency would go a long way.
How does Palo Alto reconcile the gap between Unit 42's reporting and XDR's capabilities? When your threat intel team and your detection platform are operating on different versions of the same framework, that is a problem worth addressing publicly.
Would Palo Alto consider committing to a regular ATT&CK update cadence? Something like "within 90 days of each MITRE release" would give customers confidence and predictability.
What should detection engineers do in the meantime? If there is a recommended workaround for mapping BIOCs to v19 tactics and techniques today, I would love to hear it.
I know I am not the only detection engineer staring at a BIOC dropdown wondering where half the new techniques went. If this gap is impacting your work, whether it is coverage reporting, compliance, or just the day-to-day frustration of not being able to map things correctly, drop a comment or hit the like button. The more visibility this gets, the more likely it is to land on someone's priority list.
At the end of the day, accurate ATT&CK alignment is how modern SOCs measure what they can see, what they cannot see, and where to invest next. When the framework in our detection platform falls this far behind, it is not just an inconvenience. It is a blind spot in our ability to communicate risk.
Our adversaries are definitely not waiting for a dropdown menu to get updated. We should not have to either.
Thanks for reading, and I am looking forward to the discussion.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
