MITRE ATT&CK Local Reference

Dataset

Local file: mitre-attack/enterprise-attack.json (~45 MB STIX 2.1 bundle).

First use — if the file is missing, run the bundled download script before any query:

./scripts/download-mitre.sh

The script is idempotent (skips if the file is already present) and supports --force for refresh. If scripts/download-mitre.sh is not present in the install (e.g. for plugin-only deployments), fall back to:

mkdir -p mitre-attack
curl -fsSL https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json \
  -o mitre-attack/enterprise-attack.json

This yields a STIX 2.1 bundle containing all Enterprise ATT&CK objects.

Querying the Dataset

The dataset is a JSON file with a objects array. Each object has a type field.

Find a technique by ID

cat mitre-attack/enterprise-attack.json | python3 -c "
import json, sys
data = json.load(sys.stdin)
tid = 'T1566'  # Change as needed
for obj in data['objects']:
    refs = obj.get('external_references', [])
    for ref in refs:
        if ref.get('external_id') == tid:
            print(json.dumps(obj, indent=2))
            break
"

List all techniques for a tactic

Tactics are mapped via kill_chain_phases[].phase_name:

• reconnaissance, resource-development, initial-access, execution, persistence
• privilege-escalation, defense-evasion, credential-access, discovery
• lateral-movement, collection, command-and-control, exfiltration, impact

Find a threat group

# Groups have type "intrusion-set"
cat mitre-attack/enterprise-attack.json | python3 -c "
import json, sys
data = json.load(sys.stdin)
name = 'APT28'  # Change as needed
for obj in data['objects']:
    if obj.get('type') == 'intrusion-set':
        aliases = obj.get('aliases', [])
        if name in aliases or obj.get('name') == name:
            print(json.dumps(obj, indent=2))
"

Map group to techniques

Groups link to techniques via relationship objects with relationship_type: "uses".

Find software/malware

Software objects have type malware or tool.

Key Object Types

Common ATT&CK Technique References

Usage in Analysis

• Map observed TTPs to ATT&CK technique IDs
• Cross-reference threat actor profiles with known ATT&CK groups
• Identify detection coverage gaps by comparing ATT&CK heatmap to detection rules
• Use ATT&CK Navigator for visual TTP mapping