Skip to content
Get packs

Guide · Agent skill

How to use the Mapping Threat Actor TTPs to MITRE ATT&CK agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This is an agent skill that lets an AI assistant map a threat actor's described behaviour and observed indicators to techniques in the MITRE ATT&CK knowledge base, then produce Navigator heatmaps and a detection gap view. It is aimed at security analysts writing threat intelligence reports, detection engineers checking monitoring coverage, and students learning how ATT&CK, STIX data and Navigator fit together. By the end you will know how to install the skill, how to phrase requests so it triggers, and what it needs and sends over the network.

Mapping Threat Actor TTPs to MITRE ATT&CKmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download the ZIP. Download the skill ZIP from this page and unzip it.
  2. 2Place the folder. Move the analyzing-threat-actor-ttps-with-mitre-attack folder into ~/.claude/skills/ or a project's .claude/skills/ folder.
  3. 3Or upload in the apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the ZIP.
  4. 4Install the Python libraries. Install Python 3.9+ and the libraries attackcti, mitreattack-python, stix2 and requests.
  5. 5Ask for a mapping. Name the threat actor or describe the observed behaviour and request a technique mapping.
  6. 6Generate a Navigator layer. Ask for a Navigator layer file and open it in MITRE ATT&CK Navigator to view the heatmap.
  7. 7Review the output. Check each technique against the source reports and your detection inventory before sharing the report.

What does the skill make the agent do?

Once installed, the agent can take a threat actor's known behaviours or observed indicators and map them to techniques in the MITRE ATT&CK knowledge base, a public catalogue of how real attackers operate. It can generate ATT&CK Navigator layer files, which are colour-coded heatmaps of techniques, compare several threat groups, and point out where a defender's detections may not cover the observed behaviour.

The skill covers the Enterprise, Mobile and ICS matrices. It includes a Python script that fetches ATT&CK data from MITRE's servers and produces these outputs. The skill maps described behaviour to techniques; it does not establish who is responsible for an attack.

Install the skill from the ZIP

Download the ZIP from this page and unzip it. For a personal setup, place the skill folder inside ~/.claude/skills/. For a single project, place it inside that project's .claude/skills/ folder.

Alternatively, upload the ZIP in the Claude apps under Settings → Capabilities → Skills.

  • Personal: ~/.claude/skills/analyzing-threat-actor-ttps-with-mitre-attack/
  • Project: .claude/skills/analyzing-threat-actor-ttps-with-mitre-attack/
  • Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Trigger the skill with natural requests

You do not need a special command. The skill's description says to use it when analysing threat actor TTPs, correlating IOCs to specific ATT&CK techniques, or assessing defensive detection coverage against adversary behaviour, so ask in those terms.

Name the group or describe the behaviour, and say what output you want: a Navigator layer, a technique table, or a gap list.

  • Map APT29's techniques to ATT&CK and give me a Navigator layer.
  • Here are the IOCs and behaviours from this incident; which ATT&CK techniques do they correspond to?
  • Which techniques used by this group do we have no detections for, given our current rules?

What the skill needs

You need Python 3.9 or newer and these libraries: attackcti, mitreattack-python, stix2 and requests. The workflow also needs internet access to the MITRE TAXII server and GitHub, unless you supply a local ATT&CK JSON file. MITRE ATT&CK Navigator is needed to view the layers, either web-based or local. A threat intelligence platform such as MISP or OpenCTI is optional, for threat actor data.

  • Python 3.9+
  • Python libraries: attackcti, mitreattack-python, stix2, requests
  • Internet access to MITRE TAXII and GitHub, or a local ATT&CK JSON file
  • MITRE ATT&CK Navigator (web-based or local)
  • Optional: MISP or OpenCTI
pip install mitreattack-python

Safety notes: scripts and network use

This skill runs scripts and uses the network. The default script downloads ATT&CK data from the internet, so organisations that cannot send queries to MITRE's servers or GitHub should supply a local ATT&CK JSON file instead. Review scripts/agent.py and scripts/process.py before running them.

Use this skill for report-oriented work that needs analyst review. It is not suited to live incident response where speed matters more than mapping rigour.

  • Runs scripts: yes. Uses network: yes.
  • Default data source is MITRE's TAXII server and GitHub.
  • Not for live incident response.

Tips for better results

Give the group name or ATT&CK group ID (for example APT29 or G0016) and state the date range or source reports you are working from. Ask the agent to show which evidence supports each technique, then check those links yourself before publishing.

For detection gaps, provide the list of techniques or rules you actually have. The example in the skill uses a hand-written set of detected techniques, so replace it with your own.

  • Name the group by its ATT&CK ID when you can.
  • Provide your real detection inventory for gap analysis.
  • Review every mapping against the source reports before use.

What people use it for

  • Writing a threat intelligence report on a specific adversary group, with a technique table by tactic.
  • Checking which techniques observed in an incident lack monitoring coverage in your detection set.
  • Comparing the technique usage of several threat groups in one Navigator view.
  • Learning how ATT&CK data, STIX objects and Navigator layers fit together.

Frequently asked questions

How do I install the analyzing threat actor TTPs MITRE ATT&CK skill?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.

What does this skill require?

Python 3.9 or newer, the libraries attackcti, mitreattack-python, stix2 and requests, and internet access to MITRE's TAXII server and GitHub unless you supply a local ATT&CK JSON file. MITRE ATT&CK Navigator is needed to view the layers.

Is this skill free to use?

The skill is published under the Apache-2.0 licence. The source does not list pricing, so check the licence text in the repository for the terms.

Can I use it without internet access?

Yes, if you supply a local ATT&CK JSON file. The default script downloads data from MITRE's servers and GitHub, so an offline setup needs that local file instead.

Does it prove who carried out an attack?

No. The skill maps described behaviour to ATT&CK techniques but does not establish attribution. Treat its output as a mapping to review, not a verdict on responsibility.

Is it suitable for live incident response?

Not really. The workflow is report-oriented and needs analyst review, so it is a poor fit where speed matters more than mapping rigour.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Use this skill if you are a security analyst writing structured threat intelligence reports or a detection engineer checking which observed techniques lack coverage, and you can let it reach MITRE's servers or supply a local ATT&CK file. Pick something else if you need fast live incident response, if your environment cannot make outbound queries, or if you need authoritative attribution of attacks.

Download the skill