Guide · Agent skill
How to use the Threat Actor TTP Navigator Mapping agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains what the analyzing-threat-actor-ttps-with-mitre-navigator agent skill does, how to install it, and how to ask an agent for a MITRE ATT&CK technique profile of a named APT group. It is written for readers who have not used agent skills before. By the end you will know how to get a JSON layer file that opens in the MITRE ATT&CK Navigator and how to read its limits.
Threat Actor TTP Navigator Mappingmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Download the skill ZIP from this page.
- 2Install the skill. Unzip it into ~/.claude/skills/ for all projects, or into a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Install the Python libraries. Install attackcti with pip install attackcti and make sure stix2 is available. Use Python 3.8 or newer.
- 4Ask for a group profile. Name the APT group and ask the agent for its ATT&CK techniques and a Navigator layer.
- 5Open the layer in Navigator. Load the generated JSON file into the MITRE ATT&CK Navigator web app or a local instance.
- 6Compare with your coverage. Overlay your own detection coverage on the layer to spot gaps, remembering the layer shows known associations only.
What does this skill make the agent do?
The skill is a set of instructions (SKILL.md) plus a Python helper script (scripts/agent.py) that queries ATT&CK data through the attackcti Python library. Once installed, the agent can look up a named cyber threat group, such as an APT actor, in the MITRE ATT&CK knowledge base and list the attack techniques that group is known to use.
The agent can then produce a JSON layer file. You open that file in the MITRE ATT&CK Navigator web app to colour-code the techniques. Security teams can use the result to compare the group's behaviour against their own detection coverage and look for gaps.
How do you install the skill?
Option 1: download the ZIP from this page and unzip it into your personal skills folder, ~/.claude/skills/. To make it available only inside one project, unzip it into that project's .claude/skills/ folder instead.
Option 2: in the Claude apps, go to Settings → Capabilities → Skills and upload the ZIP.
What do you need before you start?
The skill has several requirements. Check these before you try it.
- Python 3.8 or newer
- The attackcti Python library (pip install attackcti)
- The stix2 Python library
- Network access to the ATT&CK TAXII server, because attackcti pulls data online
- MITRE ATT&CK Navigator, either the web app or a local instance, to view the layer files
- Enough understanding of STIX 2.1 objects and ATT&CK terminology to interpret the results
pip install attackctiHow do you trigger the skill with a natural request?
You do not need a special command. Describe the task in plain language and name the group. The skill's description covers profiling an APT group's techniques, building Navigator coverage heatmaps, and assessing technique coverage gaps against a specific threat actor.
Requests that fit well include asking for the techniques a named group uses, asking for a Navigator layer for that group, or asking to compare a group's techniques with your own coverage.
- "Use the MITRE Navigator skill to list the ATT&CK techniques used by APT29 and build a layer file."
- "Profile the techniques of this APT group and create an ATT&CK Navigator layer I can open in the web app."
- "Show me which techniques this threat actor uses that we have no detection for, using a Navigator layer."
What does the output look like?
The source shows an example layer file. Each technique is listed with its ID, a score, and a comment. The layer name and the ATT&CK domain are included at the top level.
Scores here reflect known group-technique associations from ATT&CK data. They are not measurements of your own defences.
{
"name": "APT29 TTPs",
"domain": "enterprise-attack",
"techniques": [
{"techniqueID": "T1566.001", "score": 1, "comment": "Spearphishing Attachment"},
{"techniqueID": "T1059.001", "score": 1, "comment": "PowerShell"}
]
}What safety points should you know?
This skill runs scripts and uses the network. The helper script queries the ATT&CK TAXII server online, so the machine running it needs outbound access to that server. Read scripts/agent.py before running it if you need to confirm what it does.
The data is a static ATT&CK snapshot pulled through attackcti, so it is not a live threat feed. Do not use it for real-time incident response.
What tips help you get better results?
Use the exact group name that ATT&CK uses, or one of its known aliases. The API reference lists group fields such as name and aliases.
Treat the layer as a list of known associations. To find gaps, you must still compare it against your own detection data.
Load the generated JSON into the Navigator web app or a local instance to view it.
What people use it for
- Profiling a specific APT group before a threat review or tabletop exercise.
- Building a Navigator heatmap of a group's techniques for a team discussion.
- Comparing a group's known techniques with your current detection coverage to find gaps.
- Learning how ATT&CK, STIX data and Navigator layers fit together.
Frequently asked questions
How do I install the analyzing-threat-actor-ttps-with-mitre-navigator skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
What do I need to run this skill?
You need Python 3.8 or newer, the attackcti and stix2 Python libraries, network access to the ATT&CK TAXII server, and MITRE ATT&CK Navigator to view the layer files.
Is this skill free to use?
The skill is published under the Apache-2.0 licence. Check the licence file in the repository for the full terms before you reuse it.
Does the skill give real-time threat intelligence?
No. It relies on a static ATT&CK snapshot pulled through attackcti, so the output is only as current as the data it retrieves. It is not suitable for real-time incident response.
Does the layer show whether my controls detect these techniques?
No. The layer reflects known group-technique associations from ATT&CK. It does not verify whether your own controls detect them, so you need your own detection data for that.
What is an ATT&CK Navigator layer file?
It is a JSON file that lists techniques with IDs, scores and comments. The Navigator web app reads it and colour-codes the matrix, which is useful for visual comparison.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits SOC analysts, threat intelligence teams and students who want a quick, structured ATT&CK technique list and Navigator layer for a named APT group. It is a poor fit for live incident response, for anyone expecting verified coverage scores, or for readers who do not know ATT&CK terminology.
Download the skill