Skip to main content

MPT-3. Develop Tactical Objectives/Tasks

Tactical Objectives/Tasks​

Definitions
  • TO (Tactical Objective) = The overall goal that the aggregate TTs are aligned to meet
  • MOE (Measure of Effect) = The qualatative outcome expected from completing all related TTs successfully
  • TT (Tactical Task) = A specific action that the ME (Mission Element) needs to perform
  • MOP (Measure of Performance) = A quantifiable outcome expected from completing the TT successfully

These Tactical Objectives/Tasks can be used an the initial template for executing the Host Data Collection plans. This template should be tailored to the specific mission and tasks to be performed. For example, if there is no need or plan to configure Syslog during the mission, then it should be removed as a Tactical Task.

TO-1: Deploy CVA/H host sensors to endpoints within the DAL
MOE: System event logs are streamed for real time monitoring and detection of MCA

  • TT-1.1: Deploy host agents to targeted endpoints IAW the Host Agent Deployment plan and 262COS-HA-SOP-002
    • MOP: Endgame is successfuly installed on all targeted endpoints
    • MOP: Sysmon is successfuly installed on all targeted endpoints
    • MOP: Winlogbeat is successfuly installed on all targeted endpoints
    • MOP: Auditbeat is successfuly installed on all targeted endpoints
    • MOP: Filebeat and tailored configuration file is successfuly installed on all targeted endpoints
    • MOP: All deployed agents are sending the correct logs to CVA/H
  • TT-1.2: Configure Syslog forwarding on all targeted MRT-C assets
    • MOP: Targeted network infrastructure devices are configured to stream logs via Syslog to CVA/H
    • MOP: Targeted endpoints are configured to stream logs via Syslog to CVA/H

TO-2: Collect point-in-time data from endpoints within the DAL
MOE: Data collected can be used to enable MCA hunt/detection as well as update DAL inventories and terrain diagrams for accurate defense prioritization

  • TT-2.1: Collect point-in-time data IAW the Metaspose Collection Plan
    • MOP: System information collection jobs are executed against all targeted endpoints
    • MOP: Volatile information collection jobs are executed against all targeted endpoints
    • MOP: Persistence information collection jobs are executed against all targeted endpoints