Guide · Agent skill
How to use the APT Group Navigator Analysis agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains the analyzing-apt-group-with-mitre-navigator agent skill, a set of instructions and scripts that lets an AI agent query MITRE ATT&CK data about named threat groups and turn their techniques into ATT&CK Navigator heatmap files. It is written for readers who have not used agent skills before. By the end you will know how to install the skill, how to ask for an analysis in plain language, and what files and limits to expect.
APT Group Navigator Analysismukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Download the skill ZIP from this page. It is licensed under Apache-2.0.
- 2Install the skill. Unzip it into ~/.claude/skills/ for personal use or into .claude/skills/ in a project, or upload the ZIP in the Claude apps under Settings, then Capabilities, then Skills.
- 3Install the libraries. Make sure Python 3.9 or newer is available and install attackcti, mitreattack-python, stix2 and requests.
- 4Ask for an analysis. Describe the group and the output you want in plain words, naming the group by its ATT&CK name or G-code.
- 5Open the layer. Load the generated layer JSON file into the ATT&CK Navigator web app to view the heatmap.
- 6Review the gaps. Check the techniques the agent marks as uncovered against your own detection coverage before acting on them.
What does the skill make the agent do?
The skill teaches an agent to pull MITRE ATT&CK data about threat groups (APT actors) using the attackcti, mitreattack-python and stix2 Python libraries. It then converts a group's known techniques into a Navigator layer, which is a JSON file that colors techniques in MITRE's ATT&CK Navigator web tool.
The agent can also load several groups at once, find techniques they share, list techniques unique to each group, and compare that against a list of techniques your own detection covers. The output is a JSON layer file plus a written summary for threat-intel reports.
Install the skill in Claude
Download the ZIP of the skill from this page. Then choose one of two routes.
For Claude Code, unzip it into ~/.claude/skills/ to make it available everywhere, or into a project's .claude/skills/ folder to limit it to that project.
In the Claude apps, upload the ZIP under Settings, then Capabilities, then Skills.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project folder
- Claude apps: Settings → Capabilities → Skills
Check the requirements before you run it
The skill needs Python 3.9 or newer and these libraries: attackcti, mitreattack-python, stix2 and requests. It needs internet access to fetch ATT&CK data, unless you supply a local copy of enterprise-attack.json. The ATT&CK Navigator web app is needed only if you want to view the layer visually in a browser.
MISP or OpenCTI are optional sources of threat actor data. The skill's reference notes also show how to download the enterprise ATT&CK bundle with curl from the MITRE CTI repository if you prefer a local file.
- Python 3.9+ with attackcti, mitreattack-python, stix2, requests
- Internet access, or a local enterprise-attack.json
- Optional: MISP or OpenCTI access
- Optional: browser access to the ATT&CK Navigator web app
lift.get_techniques_used_by_group("G0016")How do you trigger the skill with a natural request?
You do not need to name the skill. Describe the task in plain words that mention an APT group, ATT&CK, or Navigator, and mention what you want back, such as a layer file or a gap list.
Good requests name the group by its ATT&CK name or G-code and say whether you want one group, a comparison, or a gap analysis against your detections. The skill's own examples use G0016 for APT29, G0007 for APT28 and G0032 for Lazarus Group.
- Build an ATT&CK Navigator layer for APT29 (G0016) and save it as a JSON file.
- Compare APT29, APT28 and Lazarus Group. Which techniques do all three use?
- Using this list of techniques we detect today, show which APT28 techniques we miss.
- Summarize the techniques unique to Lazarus Group for a threat-intel report.
What output should you expect?
For a single group, the agent produces a layer JSON file named after the group, for example apt29_layer.json in the sample code. Each technique is colored and carries a comment with its name and a metadata entry for the group and platforms. You load that file into the ATT&CK Navigator web app to see the heatmap.
For comparisons, the agent reports counts and lists of shared and unique techniques. Multi-layer overlays let you view your detection coverage and a group's techniques together to find gaps.
Safety and limits
The skill runs scripts and uses the network, so read scripts/agent.py before running it in a sensitive environment. The skill works from static ATT&CK reference data. It does not read your logs and cannot confirm that an attack is happening, so it is not suited to live incident response.
The output assumes familiarity with ATT&CK and STIX. Readers without a security background who need a plain-language briefing should look elsewhere.
- It runs scripts and fetches data over the network.
- It does not analyze your own logs or live activity.
- Your detection list is only as accurate as what you give it.
What people use it for
- Detection engineers checking which attacker techniques their monitoring misses.
- Threat-intel analysts preparing Navigator heatmaps for a report.
- Security teams comparing technique overlap between several threat groups.
- Building a written summary of a group's techniques for a briefing.
Frequently asked questions
How do I install the APT Group Navigator Analysis agent skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. In the Claude apps, you can instead upload the ZIP under Settings, then Capabilities, then Skills.
Is the analyzing-apt-group-with-mitre-navigator skill free to use?
The skill is licensed under Apache-2.0, as stated on this page. The ATT&CK data it queries comes from MITRE's public reference material, and the source does not mention any cost.
What do I need to run this skill?
You need Python 3.9 or newer with attackcti, mitreattack-python, stix2 and requests installed. You also need internet access to fetch ATT&CK data, or a local copy of enterprise-attack.json. Browser access to the ATT&CK Navigator web app is optional.
Does the skill work offline?
Not by default, because it fetches ATT&CK data over the network. The source says you can use a local copy of enterprise-attack.json instead of downloading it.
How is this different from just using the ATT&CK Navigator website?
The Navigator website lets you color techniques by hand. This skill gathers a group's techniques from ATT&CK data automatically, builds the layer file, and compares several groups or your detection list in one step.
Why does the skill not show what is happening in my network?
It works from static ATT&CK reference data and does not read your logs. It cannot confirm that an attack is happening, so use it for planning and detection-gap work rather than live incident response.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a detection engineer, threat-intel analyst or security team that wants repeatable ATT&CK Navigator heatmaps and gap lists for one or more APT groups, and you are comfortable with ATT&CK and STIX. Pick something else if you need live incident response on your own logs, or a plain-language threat briefing for non-specialists.
Download the skill