A security administrator is hardening corporate systems and applying appropriate mitigations by consulting a real-world knowledge base for adversary behavior. Which of the following would be best for the administrator to reference?

MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It provides a comprehensive framework for understanding and combating cyber threats, making it ideal for hardening systems against known adversary behaviors. CSIRT (Computer Security Incident Response Team) is a team that responds to security incidents, not a knowledge base for adversary behavior. CVSS (Common Vulnerability Scoring System) is a standardized method for rating the severity of vulnerabilities, not a compendium of adversary techniques. SOAR (Security Orchestration, Automation, and Response) refers to a stack of technologies that allow organizations to collect threat data and automate responses, rather than a knowledge base of adversary behaviors.