mapping-mitre-attack-techniques

# Mapping MITRE ATT&CK Techniques ## When to Use Use this skill when: - Generating an ATT&CK coverage heatmap to show which techniques your detection stack addresses - Tagging existing SIEM use cases or Sigma rules with ATT&CK technique IDs for structured reporting - Aligning your security program roadmap to specific adversary groups known to target your sector **Do not use** this skill for real-time incident triage — ATT&CK mapping is an analytical activity best performed post-detection or during threat hunting planning. ## Prerequisites - Access to MITRE ATT&CK knowledge base (https://attack.mitre.org) or local ATT&CK STIX data bundle - ATT&CK Navigator web app or local installation (https://mitre-attack.github.io/attack-navigator/) - Inventory of existing detection rules (Sigma, Splunk, Sentinel KQL) to assess current coverage - ATT&CK Python library: `pip install mitreattack-python` ## Workflow ### Step 1: Obtain Current ATT&CK Data Download the latest ATT&CK STIX bundle for the relevant matrix (Enterprise, Mobile, ICS): ```bash curl -o enterprise-attack.json \ https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json ``` Use the mitreattack-python library to query techniques programmatically: ```python from mitreattack.stix20 import MitreAttackData mitre = MitreAttackData("enterprise-attack.json") techniques = mitre.get_techniques(remove_revoked_deprecated=True) for t in techniques[:5]: print(t["external_references"][0]["...