CFTR comes with an inbuilt TTP correlation engine that harnesses data from multiple threat intel sources. It fetches TTPs using an inbuilt Mitre ATT&CKᵀᴹ Navigator and Incident IOC data from the Incident module within CFTR. The entire data is correlated and mapped by the TTP correlation engine to produce a consumable and informative output called ATT&CK Heatmap.