What is CAPEC; how does it differ from CWE?

Short answer

CAPEC (Common Attack Pattern Enumeration and Classification) is the catalog of attack patterns published by MITRE; each pattern defines, with an ID such as CAPEC-66 (SQL Injection), the method that an attacker follows while exploiting a weakness (capec.mitre.org). CWE, on the other hand, classifies the weakness types in software (cwe.mitre.org): CWE answers the question "what flaw is in the application?", CAPEC the question "by which method is this flaw exploited?", and CAPEC patterns are linked to the related CWEs. In TR7 WAF, about half of the built-in Signature & Rule Library rules (1,662 of 3,294 rules) are mapped to at least one CAPEC ID; in the others, the field is empty. CAPEC appears in the Signature & Rule Library on the CAPEC Coverage card, in the CAPEC column and in the Filter window; in WAF Event Logs on the CAPEC filter tab and in the record preview; in the Classification view of the WAF report; and, if selected, in the capec field of the attack information sent to SIEM (Attack Details in WAF Info).

Where It Is Used in TR7

Where	Field / label	What for
Configuration Menu → WAF → Signature & Rule Library; the OWASP Rules screen of the vService	CAPEC Coverage card	The number of distinct CAPEC patterns that occur in the library
The same screens	CAPEC column (hidden by default); Filter → CAPEC Coverage group; the Classification tab of the rule preview	Seeing the CAPEC counterpart of a rule or listing the rules mapped to a pattern
WAF Event Logs and Global WAF Event Log	CAPEC tab on the filter strip; CAPEC row on the Summary and Attacks tabs of the record preview	Seeing the attack patterns of the triggered signatures and filtering the records by pattern
WAF report	Classification view	CAPEC breakdown in the report
vService → WAF Management → SIEM & Attack Details	Attack Details in WAF Info → CAPEC (List)	Adding the capec field to the attack information sent to SIEM

• In the custom rules added by the user, the CAPEC field is empty.
• The steps for seeing all the classification counterparts of a rule: How do I see which OWASP Top 10, CWE, CAPEC and MITRE ATT&CK entries a rule maps to?

Difference from CWE

	CWE	CAPEC
What it classifies	The weakness type in software	The attack method that exploits the weakness
Example	CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	CAPEC-66: SQL Injection
Who it is useful for	Developers and code review: what is to be fixed	Defense and threat analysis: how the attack is carried out
In TR7 WAF	Filled in for the large majority of built-in rules	Filled in for about half of built-in rules
Details	What is CWE; why does it appear in TR7 WAF logs and reports?	This page

Common Misconceptions

• "CAPEC and CWE are the same list." One classifies the weakness, the other the attack pattern aimed at that weakness; a CAPEC pattern can be linked to more than one CWE.
• "Every rule has CAPEC." CAPEC is not defined in about half of the built-in rules; these rules produce no value for the CAPEC tab in Event Logs.
• "CAPEC always goes to SIEM." The capec field is sent only if CAPEC (List) is selected in the Attack Details in WAF Info list.

How it is done in the documentation

• Signature & Rule Library · The Library Summary Cards
• Signature & Rule Library · Preview of the Selected Rule
• Event Logs · The Filterable Information
• SIEM & Attack Details · Attack Details in WAF Info

Related questions

• How do I see which OWASP Top 10, CWE, CAPEC and MITRE ATT&CK entries a rule maps to?
• Which attack fields are sent to the SIEM (score, severity, scope, name, category, CWE, MITRE, CAPEC, OWASP, target)?
• What is CWE; why does it appear in TR7 WAF logs and reports?