MITRE ATT&CK

attack-navigator

Web app that provides basic navigation and annotation of ATT&CK matrices

car

Cyber Analytics Repository

attack-scripts

Scripts and a (future) library to improve users' interactions with the ATT&CK content

bzar

A set of Zeek scripts to detect ATT&CK techniques.

attack-arsenal

A collection of red team and adversary emulation resources developed and released by MITRE.

attack-website

MITRE ATT&CK Website

mitreattack-python

A python module for working with ATT&CK

attack-datasources

This content is analysis and research of the data sources currently listed in ATT&CK.

attack-stix-data

STIX data representing MITRE ATT&CK

tram

Threat Report ATT&CK™ Mapping (TRAM) is a tool to aid analyst in mapping finished reports to ATT&CK.

joystick

Joystick is a tool that gives you the ability to transform the ATT&CK Evaluations data into concise views that brings forward the nuances in the results.

attack-evals

ATT&CK Evaluations website (DEPRECATED)

evals_caldera

A CALDERA plugin for ATT&CK Evaluations Round 1

caret

CARET - A tool for viewing cyber analytic relationships

attack-datasources-stix-beta

Mock STIX data demonstrating the new data source representation

attack-workbench-taxii-server

An application allowing users to explore, create, annotate, and share extensions of the MITRE ATT&CK® knowledge base. This repository contains a TAXII 2.1 API integration for the ATT&CK Workbench application.

attack-archives

Previous ATT&CK releases as seen at https://attack.mitre.org/resources/previous-versions/

attack-data-model

ATT&CK Data Model (ADM): A TypeScript library for structured interaction with MITRE ATT&CK datasets. Uses Zod schemas, TypeScript types, and ES6 classes to provide a type-safe, object-oriented interface for STIX 2.1 formatted ATT&CK data. Features parsing, validation, and serialization capabilities.

attack-workbench-deployment