### Install Dependencies Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/CONTRIBUTING.md Installs all project dependencies, including development and documentation extras. This can be done using the 'just' command or 'uv sync'. ```bash just install # or without just: uv sync --all-extras ``` -------------------------------- ### Setup Pre-commit Hooks Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/CONTRIBUTING.md Installs pre-commit hooks for local linting and commit message validation. This ensures code quality and consistent commit messages. ```bash just setup-hooks # or without just: uv run pre-commit install uv run pre-commit install --hook-type commit-msg ``` -------------------------------- ### Install mitreattack-python with pip Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/installation.md Use this command to install the library. Ensure you have Python 3 installed. ```shell pip install mitreattack-python ``` -------------------------------- ### Retrieve Procedure Examples by Technique Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Fetches a list of procedure examples associated with a specific technique, identified by its STIX ID. ```APIDOC ## get_procedure_examples_by_technique(stix_id: str) ### Description Retrieve the list of procedure examples by technique. ### Parameters #### Path Parameters - **stix_id** (str) - Required - The STIX ID of the technique. ### Returns - A list of Relationship objects describing the software, groups, and campaigns using the technique. - Return type: list[Relationship] ``` -------------------------------- ### Install Dependencies Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/RELEASE.md Installs project dependencies, including development tools, required for local validation. ```bash just install ``` -------------------------------- ### DiffStix Example Execution Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/diffStix/README.md An example command demonstrating how to use diff_stix to generate various output formats including HTML, detailed HTML, markdown, JSON, and ATT&CK Navigator layers. It specifies input directories for old and new STIX data and enables verbose output. ```shell diff_stix -v --show-key --html-file output/changelog.html --html-file-detailed output/changelog-detailed.html --markdown-file output/changelog.md --json-file output/changelog.json --layers output/layer-enterprise.json output/layer-mobile.json output/layer-ics.json --old path/to/old/stix/ --new path/to/new/stix/ ``` -------------------------------- ### Get All Techniques Used by All Software Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves a mapping of software to the techniques it employs. ```APIDOC ## get_all_techniques_used_by_all_software() ### Description Get all techniques used by all software. ### Returns Mapping of software_stix_id to RelationshipEntry[Technique] for each technique used by the software. ### Return type RelationshipMapT[Technique] ``` -------------------------------- ### Copy .env.example to .env Source: https://github.com/mitre-attack/mitreattack-python/blob/main/examples/README.md Copy the example environment file to a new file named .env. Edit this file to set paths and variables for your environment. ```sh cp .env.example .env ``` -------------------------------- ### Get All Software Using All Techniques Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves a mapping of all techniques to the software that employs them. ```APIDOC ## get_all_software_using_all_techniques() ### Description Get all software using all techniques. ### Returns Mapping of technique_stix_id to RelationshipEntry[Software] for each software using the technique. ### Return type RelationshipMapT[Software] ``` -------------------------------- ### Example Usage of ToExcel Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/navlayers/README.md Demonstrates loading a layer from a file and exporting it to Excel. Shows initialization of ToExcel with both local STIX data and a remote ATT&CK Workbench instance. ```python from mitreattack.navlayers import Layer from mitreattack.navlayers import ToExcel lay = Layer() lay.from_file("path/to/layer/file.json") # Using local stix data for template t2 = ToExcel(domain='mobile', source='local', resource='path/to/local/stix.json') t2.to_xlsx(layerInit=lay, filepath="demo.xlsx") # Using remote ATT&CK Workbench instance for template workbench_url = 'localhost:3000' t3 = ToExcel(domain='ics', source='remote', resource=workbench_url) ``` -------------------------------- ### Run Python Script Source: https://github.com/mitre-attack/mitreattack-python/blob/main/examples/README.md Execute individual Python scripts from the examples directory using the python interpreter. ```sh python get_all_techniques.py ``` -------------------------------- ### Example Usage of UsageLayerGenerator Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/navlayers/README.md Demonstrates initializing UsageLayerGenerator and generating layers for specific ATT&CK objects using their IDs or aliases. ```python from mitreattack.navlayers import UsageLayerGenerator handle = UsageLayerGenerator(source='local', domain='enterprise') layer1 = handle.generate_layer(match='G0018') layer2 = handle.generate_layer(match='Adups') ``` -------------------------------- ### Get All Techniques Used by All Campaigns Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves a mapping of campaigns to the techniques they employ. ```APIDOC ## get_all_techniques_used_by_all_campaigns() ### Description Get all techniques used by all campaigns. ### Returns Mapping of campaign_stix_id to RelationshipEntry[Technique] for each technique used by the campaign. ### Return type RelationshipMapT[Technique] ``` -------------------------------- ### Get All Software Used by All Campaigns Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves a mapping of all campaigns to the software they utilize. ```APIDOC ## get_all_software_used_by_all_campaigns() ### Description Get all software used by all campaigns. ### Returns Mapping of campaign_stix_id to RelationshipEntry[Software] for each software used by the campaign. ### Return type RelationshipMapT[Software] ``` -------------------------------- ### Get All Subtechniques of All Techniques Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves a mapping of all parent techniques to their respective subtechniques. ```APIDOC ## get_all_subtechniques_of_all_techniques() ### Description Get all subtechniques of all parent techniques. ### Returns Mapping of technique_stix_id to RelationshipEntry[Technique] for each subtechnique of the technique. ### Return type RelationshipMapT[Technique] ``` -------------------------------- ### layerExporter_cli SVG Export Example Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/navlayers/README.md Example of using layerExporter_cli to export layer files to SVG format, specifying a local source and a custom configuration JSON. ```commandline C:\Users\attack>layerExporter_cli -m svg -s local -l settings/config.json -o output/svg1.json output/svg2.json files/layer1.json files/layer2.json ``` -------------------------------- ### Get All Techniques Targeting All Assets Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves a mapping of assets to the techniques that target them. ```APIDOC ## get_all_techniques_targeting_all_assets() ### Description Get all techniques targeting all assets. ### Returns Mapping of asset_stix_id to RelationshipEntry[Technique] for each technique targeting the asset. ### Return type RelationshipMapT[Technique] ``` -------------------------------- ### layerGenerator_cli Overview Layer Generation Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/navlayers/README.md Example of generating an ATT&CK Navigator layer file for the mobile domain, summarizing mitigations across the dataset using a local source. ```commandline C:\Users\attack>layerGenerator_cli --domain mobile --source local --overview-type mitigation --output generated_layer2.json ``` -------------------------------- ### Execute Basic Command Line Export Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/attackToExcel/README.md Performs a basic export using the attack-to-excel command-line tool. This is a simple way to start generating Excel files. ```shell attack-to-excel from-stix ``` -------------------------------- ### layerGenerator_cli Datasource Overview Layer Generation Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/navlayers/README.md Example of generating an ATT&CK Navigator layer file for the enterprise domain, summarizing datasources across the dataset using a local source. ```commandline C:\Users\attack>layerGenerator_cli --domain enterprise --source local --overview-type datasource --output generated_layer3.json ``` -------------------------------- ### Create ATT&CK Layer Programmatically (Object Initialization) Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/navlayers/core/README.md An alternative method to create layers by instantiating and modifying core library objects directly. This approach may be more intuitive for users than dictionary initialization. These examples produce equivalent internal layers. ```python import mitreattack.navlayers as navlayers layer_example = navlayers.Layer(name="example", domain="enterprise-attack") # arguments required for every layer layer_build = layer_example.layer # short handle to make the rest of this example easier to read # configure the versions object versions_obj = navlayers.Versions() versions_obj.layer = "4.2" versions_obj.attack = "9.1" versions_obj.navigator = "4.2" layer_build.versions = versions_obj ``` -------------------------------- ### layerGenerator_cli Batch Layer Generation Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/navlayers/README.md Example of initiating a batch generation of ATT&CK Navigator layer files for the ICS domain, with each file representing a different software instance, using a local source. ```commandline C:\Users\attack>layerGenerator_cli --domain ics --source local --batch-type software ``` -------------------------------- ### layerGenerator_cli Mapped Layer Generation Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/navlayers/README.md Example of generating an ATT&CK Navigator layer file for the enterprise domain, mapping techniques to a specific software (S0065) using a local source. ```commandline C:\Users\attack>layerGenerator_cli --domain enterprise --source local --mapped-to S0065 --output generated_layer.json ``` -------------------------------- ### Get All Techniques Detected by All Detection Strategies Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves a mapping of detection strategies to the techniques they detect. ```APIDOC ## get_all_techniques_detected_by_all_detection_strategies() ### Description Get all techniques detected by all detection strategies. ### Returns Mapping of detection_strategy_stix_id to RelationshipEntry[Technique] for each technique detected by the detection strategy. ### Return type RelationshipMapT[Technique] ``` -------------------------------- ### Get All Techniques Detected by All Data Components Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves a mapping of data components to the techniques they detect. ```APIDOC ## get_all_techniques_detected_by_all_datacomponents() ### Description Get all techniques detected by all data components. ### Returns Mapping of datacomponent_stix_id to RelationshipEntry[Technique] describing the detections of the data component. ### Return type RelationshipMapT[Technique] ``` -------------------------------- ### DiffStix Command Line Usage Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/diffStix/README.md Displays full usage instructions for the diff_stix command. Requires `pip install mitreattack-python`. Use this to understand all available options for comparing STIX bundles. ```shell # You must run `pip install mitreattack-python` in order to access the diff_stix command diff_stix --help usage: diff_stix [-h] [--old OLD] [--new NEW] [--domains {enterprise-attack,mobile-attack,ics-attack} [{enterprise-attack,mobile-attack,ics-attack} ...]] [--markdown-file MARKDOWN_FILE] [--html-file HTML_FILE] [--html-file-detailed HTML_FILE_DETAILED] [--json-file JSON_FILE] [--layers [LAYERS ...]] [--site_prefix SITE_PREFIX] [--additional-formats-prefix ADDITIONAL_FORMATS_PREFIX] [--unchanged] [--use-mitre-cti] [--show-key] [--contributors] [--no-contributors] [-v] Create changelog reports on the differences between two versions of the ATT&CK content. Takes STIX bundles as input. For default operation, put enterprise-attack.json, mobile-attack.json, and ics-attack.json bundles in 'old' and 'new' folders for the script to compare. options: -h, --help show this help message and exit --old OLD Directory to load old STIX data from. --new NEW Directory to load new STIX data from. --domains {enterprise-attack,mobile-attack,ics-attack} [{enterprise-attack,mobile-attack,ics-attack} ...] Which domains to report on. Choices (and defaults) are enterprise-attack, mobile-attack, ics-attack --markdown-file MARKDOWN_FILE Create a markdown file reporting changes. --html-file HTML_FILE Create HTML page from markdown content. --html-file-detailed HTML_FILE_DETAILED Create an HTML file reporting detailed changes. --json-file JSON_FILE Create a JSON file reporting changes. --layers [LAYERS ...] Create layer files showing changes in each domain expected order of filenames is 'enterprise', 'mobile', 'ics', 'pre attack'. If values are unspecified, defaults to output/January_2023_Updates_Enterprise.json, output/January_2023_Updates_Mobile.json, output/January_2023_Updates_ICS.json, output/January_2023_Updates_Pre.json --site_prefix SITE_PREFIX Prefix links in markdown output, e.g. [prefix]/techniques/T1484 --additional-formats-prefix ADDITIONAL_FORMATS_PREFIX Prefix detailed HTML links to generated layers and changelog JSON. --unchanged Show objects without changes in the markdown output --use-mitre-cti Use content from the MITRE CTI repo for the -old data --show-key Add a key explaining the change types to the markdown --contributors Show new contributors between releases --no-contributors Do not show new contributors between releases -v, --verbose Print status messages ``` -------------------------------- ### Get Campaigns by Alias Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves campaigns corresponding to a given alias. Note: The query is case-sensitive. ```APIDOC ## get_campaigns_by_alias ### Description Retrieve the campaigns corresponding to a given alias. Note: the query by alias is case sensitive. ### Parameters #### Path Parameters - **alias** (str) - Required - The alias of the campaign. ### Returns - A list of Campaign objects corresponding to the alias. ### Return type list[Campaign] ``` -------------------------------- ### Get Campaigns Using Software Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves all campaigns that use a specific software, identified by its STIX ID. ```APIDOC ## get_campaigns_using_software ### Description Get all campaigns using a software. ### Parameters #### Path Parameters - **software_stix_id** (str) - Required - The STIX ID of the software. ### Returns - List of RelationshipEntry[Campaign] for each campaign using the software. ### Return type list[RelationshipEntry[Campaign]] ``` -------------------------------- ### Get All Software Used by All Groups Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves a mapping of all groups to the software they utilize, including software used by attributed campaigns. ```APIDOC ## get_all_software_used_by_all_groups() ### Description Retrieve all software used by all groups. ### Returns Mapping of group_stix_id to RelationshipEntry[Software] for each software used by the group and each software used by campaigns attributed to the group. ### Return type RelationshipMapT[Software] ``` -------------------------------- ### Get All Techniques Used by All Groups Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves a mapping of groups to the techniques they employ, including techniques used by attributed campaigns. ```APIDOC ## get_all_techniques_used_by_all_groups() ### Description Get all techniques used by all groups. ### Returns Mapping of group_stix_id to RelationshipEntry[Technique] for each technique used by the group and each technique used by campaigns attributed to the group. ### Return type RelationshipMapT[Technique] ``` -------------------------------- ### LayerOps Example: Average Scores (Dictionary Mode) Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/navlayers/README.md Combines layer files from a dictionary, averaging scores and using specific keys for processing. The resulting layer is converted to a dictionary and printed. ```python # Example 2) Build a LayerOps object that takes a dictionary and averages scores across the layers lo2 = LayerOps(score=lambda x: sum([x[y] for y in x]) / len([x[y] for y in x]), colors=lambda x: x['b'], desc=lambda x: "This is a dict example") # Build LayerOps object, with lambda out_layer3 = lo2.process({'a': demo, 'b': demo2}) # Trigger processing on a dictionary of demo and demo2 dict_layer = out_layer3.to_dict() # Retrieve dictionary representation of processed layer print(dict_layer) # Display retrieved dictionary out_layer4 = lo2.process({'a': demo, 'b': demo2, 'c': demo3})# Trigger processing on a dictionary of demo, demo2, demo3 out_layer4.to_file("C:\\demo_layer4.json") # Save averaged layer to file ``` -------------------------------- ### LayerOps Example: Average Scores (List Mode) Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/navlayers/README.md Combines multiple layer files from a list, averaging their scores and using the second layer's name. The output layer is saved to a file. ```python from mitreattack.navlayers.manipulators.layerops import LayerOps from mitreattack.navlayers.core.layer import Layer demo = Layer() demo.from_file("C:\\Users\\attack\\Downloads\\layer.json") demo2 = Layer() demo2.from_file("C:\\Users\\attack\\Downloads\\layer2.json") demo3 = Layer() demo3.from_file("C:\\Users\\attack\\Downloads\\layer3.json") # Example 1) Build a LayerOps object that takes a list and averages scores across the layers lo = LayerOps(score=lambda x: sum(x) / len(x), name=lambda x: x[1], desc=lambda x: "This is an list example") # Build LayerOps object out_layer = lo.process([demo, demo2]) # Trigger processing on a list of demo and demo2 layers out_layer.to_file("C:\\demo_layer1.json") # Save averaged layer to file out_layer2 = lo.process([demo, demo2, demo3]) # Trigger processing on a list of demo, demo2, demo3 visual_aid = out_layer2.to_dict() # Retrieve dictionary representation of processed layer ``` -------------------------------- ### Display Full Usage Instructions Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/attackToExcel/README.md Prints the complete command-line usage instructions for the attack-to-excel tool. Use this to understand all available options. ```shell attack-to-excel --help ``` -------------------------------- ### Create and Load ATT&CK Navigator Layers Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/navlayers/README.md Demonstrates creating Layer objects from dictionaries and files, and saving them to disk. Use Layer() to initialize, from_dict() or from_file() to load data, and to_file() to save. ```python example_layer3_dict = { "name": "example layer", "version": "3.0", "domain": "mitre-enterprise" } example_layer4_dict = { "name": "layer v4.3 example", "versions" : { "attack": "8", "layer" : "4.3", "navigator": "4.4.4" }, "domain": "enterprise-attack" } example_layer_location = "/path/to/layer/file.json" example_layer_out_location = "/path/to/new/layer/file.json" from mitreattack.navlayers.core import Layer layer1 = Layer(example_layer3_dict) # Create a new layer and load existing data layer1.to_file(example_layer_out_location) # Write out the loaded layer to the specified file layer2 = Layer() # Create a new layer object layer2.from_dict(example_layer4_dict) # Load layer data into existing layer object print(layer2.to_dict()) # Retrieve the loaded layer's data as a dictionary, and print it layer3 = Layer() # Create a new layer object layer3.from_file(example_layer_location) # Load layer data from a file into existing layer object ``` -------------------------------- ### Build Package Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/RELEASE.md Builds the project package. ```bash just build ``` -------------------------------- ### Building a Layer Piece by Piece Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/navlayers/core/README.md Demonstrates how to construct a layer object step-by-step by configuring its various properties like description, filters, sorting, layout, and techniques. ```python # set a description layer_build.description = "This is a demonstration of how to set up a layer piece by piece" # configure the "filters" object filter_obj = navlayers.core.Filter(domain="enterprise-attack") filter_obj.platforms = ['Windows'] layer_build.filters = filter_obj # configure the 'sorting' setting layer_build.sorting = 3 # 0: sort ascending alphabetically by technique name # 1: sort descending alphabetically by technique name # 2: sort ascending by technique score # 3: sort descending by technique score # configure the layout object layout_obj = navlayers.core.Layout() layout_obj.layout = "side" layout_obj.showID = True layout_obj.showName = True layout_obj.showAggregateScores = True layout_obj.expandedSubtechniques = "annotated" layout_obj.countUnscored = True layout_obj.aggregateFunction = "sum" # average, sum, max, min layer_build.layout = layout_obj # configure whether or not to hide disabled techniques layer_build.hideDisabled = True # configure the gradient object gradient_obj = navlayers.core.Gradient(colors=["#DAF7A6", "#FFC300", "#FF5733", "#C70039", "#900C3F", "#581845"], minValue=-100, maxValue=100) layer_build.gradient = gradient_obj # configure collection of legend items legend_item_obj_a = navlayers.core.LegendItem(label='A', color='#DAF7A6') legend_item_obj_b = navlayers.core.LegendItem(label='B', color='#581845') list_of_legend_items = [legend_item_obj_a, legend_item_obj_b] layer_build.legendItems = list_of_legend_items # configure collection of metatdata values metadata_object = navlayers.core.Metadata(name='example metadata', value='This is an example') layer_build.metadata = [metadata_object] # create listing of techniques in this layer technique_obj_a = navlayers.core.Technique(tID='T1000') technique_obj_a.tactic = 'privilege-escalation' technique_obj_a.score = 15 technique_obj_a.color = '#AABBCC' technique_obj_b = navlayers.core.Technique(tID='T1000.1') technique_obj_b.tactic = 'privilege-escalation' technique_obj_b.score = 1 technique_obj_b.comment = "Demo" layer_build.techniques = [technique_obj_a, technique_obj_b] ``` -------------------------------- ### Common Development Commands Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/CONTRIBUTING.md Provides a list of frequently used commands for development tasks such as linting, testing, and building the package. Use 'just test-fast' for quick local iterations. ```bash just lint # Run pre-commit hooks (ruff format) on all files just test # Run the full test suite, matching CI expectations just test-fast # Run the fast local subset, excluding integration and slow tests just test-xdist # Run tests in parallel just test-cov # Run tests with coverage report just test-cov-xdist # Run tests with coverage in parallel just build # Build the package ``` -------------------------------- ### get_mitigations_mitigating_technique Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Get all mitigations mitigating a specific technique identified by its STIX ID. ```APIDOC ## get_mitigations_mitigating_technique ### Description Get all mitigations mitigating a specific technique identified by its STIX ID. ### Parameters - **technique_stix_id** (str) - The STIX ID of the technique. ### Returns List of RelationshipEntry[Mitigation] for each mitigation mitigating the technique. ### Return type list[RelationshipEntry[Mitigation]] ``` -------------------------------- ### get_groups_using_technique Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Get all groups using a specific technique identified by its STIX ID. ```APIDOC ## get_groups_using_technique ### Description Get all groups using a specific technique identified by its STIX ID. ### Parameters - **technique_stix_id** (str) - The STIX ID of the technique. ### Returns List of RelationshipEntry[Group] for each group using the technique and each campaign attributed to groups using the technique. ### Return type list[RelationshipEntry[Group]] ``` -------------------------------- ### get_groups_using_software Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Get all groups using a specific software identified by its STIX ID. ```APIDOC ## get_groups_using_software ### Description Get all groups using a specific software identified by its STIX ID. ### Parameters - **software_stix_id** (str) - The STIX ID of the software. ### Returns List of RelationshipEntry[Group] for each group using the software and each attributed campaign using the software. ### Return type list[RelationshipEntry[Group]] ``` -------------------------------- ### get_groups_attributing_to_campaign Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Get all groups attributing to a specific campaign identified by its STIX ID. ```APIDOC ## get_groups_attributing_to_campaign ### Description Get all groups attributing to a specific campaign identified by its STIX ID. ### Parameters - **campaign_stix_id** (str) - The STIX ID of the campaign. ### Returns List of RelationshipEntry[Group] for each group attributing to the campaign. ### Return type list[RelationshipEntry[Group]] ``` -------------------------------- ### Create ATT&CK Layer Programmatically (Dictionary Initialization) Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/navlayers/core/README.md Use this method to create a layer by initializing it with a dictionary. This approach is similar to automated import processes. Ensure all required arguments for a layer are provided. ```python import mitreattack.navlayers as navlayers layer_example = navlayers.Layer() layer_example.from_dict(dict(name="example", domain="enterprise-attack")) # arguments required for every layer # configure the versions object layer_example.layer.versions = dict(layer="4.5", attack="15", navigator="5.0.0") # set a description layer_example.layer.description = "This is a demonstration of how to set up a layer piece by piece" # configure the "filters" object layer_example.layer.filters = dict(platforms=['macOS']) # platforms can be provided during initialization layer_example.layer.filters.platforms = ['Windows'] # or separately # configure the 'sorting' setting layer_example.layer.sorting = 3 # 0: sort ascending alphabetically by technique name # 1: sort descending alphabetically by technique name # 2: sort ascending by technique score # 3: sort descending by technique score # configure the layout object layer_example.layer.layout = dict(layout="side", showID=True, showName=True, showAggregateScores=True, countUnscored=True, aggregateFunction="sum", # average, sum, max, min expandedSubtechniques="annotated") # all, annotated, none # configure whether or not to hide disabled techniques layer_example.layer.hideDisabled = True # configure the gradient object layer_example.layer.gradient = dict(minValue=-100, maxValue=100, colors=["#DAF7A6", "#FFC300", "#FF5733", "#C70039", "#900C3F", "#581845"]) # configure collection of legend items layer_example.layer.legendItems = [dict(label='A', color='#DAF7A6'), dict(label='B', color='#581845')] # configure collection of metatdata values layer_example.layer.metadata = [dict(name='example metadata', value='This is an example')] # create listing of techniques in this layer layer_example.layer.techniques = [dict(techniqueID='T1000', tactic='privilege-escalation', score=15, color='#AABBCC'), dict(techniqueID='T1000.1', tactic='privilege-escalation', score=1, comment='Demo')] ``` -------------------------------- ### Get All Techniques Mitigated by All Mitigations Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves a mapping of mitigations to the techniques they mitigate. ```APIDOC ## get_all_techniques_mitigated_by_all_mitigations() ### Description Get all techniques mitigated by all mitigations. ### Returns Mapping of mitigation_stix_id to RelationshipEntry[Technique] for each technique mitigated by the mitigation. ### Return type RelationshipMapT[Technique] ``` -------------------------------- ### Build Excel for Selected ATT&CK Domains from a Release Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/attackToExcel/README.md Exports Excel files for only the specified ATT&CK domains from a given release version. Use multiple --domains flags to select multiple domains. ```shell attack-to-excel from-release --version v19.0 --domains mobile-attack --domains ics-attack ``` -------------------------------- ### Initialize ToSvg Exporter Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/navlayers/README.md Instantiate the ToSvg class with domain, data source, resource, and optional configuration. The 'source' parameter dictates whether to use local STIX data or a remote ATT&CK Workbench instance. ```python x = ToSvg(domain='enterprise', source='local', resource='path/to/local/stix.json', config=None) ``` -------------------------------- ### Initialize OverviewLayerGenerator Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/navlayers/README.md Initialize the OverviewLayerGenerator to create ATT&CK layers based on object types. Requires specifying the data source, domain, and resource path. ```python x = OverviewLayerGenerator(source='local', domain='enterprise', resource=None) ``` -------------------------------- ### get_field Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Get a field from a dictionary or object. Returns a default value if the field is missing. ```APIDOC ## get_field ### Description Get a field from a dictionary or object. Returns a default value if the field is missing. ### Parameters - **obj** (dict or object with attributes) - Source to retrieve the field from. - **field** (str) - Field name or key. - **default** (any, optional) - Value to return if field is missing, by default None. ### Returns Field value or default. ### Return type Any ``` -------------------------------- ### Get Campaigns Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves all campaign objects. Optionally filters out revoked or deprecated objects. ```APIDOC ## get_campaigns ### Description Retrieve all campaign objects. Optionally remove revoked or deprecated objects. ### Parameters #### Query Parameters - **remove_revoked_deprecated** (bool) - Optional - Remove revoked or deprecated objects from the query, by default False. ### Returns - A list of Campaign objects. ### Return type list[Campaign] ``` -------------------------------- ### Get Assets Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves all asset objects. Optionally filters out revoked or deprecated objects. ```APIDOC ## get_assets ### Description Retrieve all asset objects. Optionally remove revoked or deprecated objects. ### Parameters #### Query Parameters - **remove_revoked_deprecated** (bool) - Optional - Remove revoked or deprecated objects from the query, by default False. ### Returns - A list of Asset objects. ### Return type list[Asset] ``` -------------------------------- ### Get Analytics Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves all analytic objects, with an option to exclude revoked or deprecated ones. ```APIDOC ## get_analytics(remove_revoked_deprecated: bool = False) ### Description Retrieve all analytic objects. ### Parameters * **remove_revoked_deprecated** (*bool* *,* *optional*) – Remove revoked or deprecated objects from the query, by default False. ### Returns A list of Analytic objects. ### Return type list[Analytic] ``` -------------------------------- ### Build Excel for Specific Domain and Version Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/attackToExcel/README.md Generates Excel files for a specific ATT&CK domain and version using the command-line tool. Ensure the domain and version are correctly specified. ```shell attack-to-excel from-stix --domain mobile-attack --version v5.0 ``` -------------------------------- ### Download and Build Excel for a Release Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/attackToExcel/README.md First downloads STIX files for a specific ATT&CK release version, then builds Excel files for all domains. This ensures local files are available before export. ```shell download_attack_stix -v 19.0 attack-to-excel from-release --version v19.0 ``` -------------------------------- ### Retrieve Objects by Type Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Gets a list of ATT&CK objects filtered by their STIX type. ```APIDOC ## get_objects_by_type(stix_type: str, remove_revoked_deprecated: bool = False) ### Description Retrieve objects by STIX type. ### Parameters #### Path Parameters - **stix_type** (str) - Required - The STIX type of the objects to retrieve. - **remove_revoked_deprecated** (bool) - Optional - Remove revoked or deprecated objects from the query, by default False. ### Returns - A list of STIX 2.0 Domain Objects or Custom ATT&CK objects. - Return type: list[AttackStixObject] ``` -------------------------------- ### Instantiate and Use Custom STIX Objects Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/custom_objects.md Demonstrates how to initialize MitreAttackData, retrieve objects by STIX ID or ATT&CK ID, and access their attributes. Use this to work with custom MITRE ATT&CK objects. ```python from mitreattack.stix20 import MitreAttackData # build the source data mitre_attack_data = MitreAttackData("enterprise-attack.json") # retrieve group G0019 by STIX ID (stix2 Domain Object) group = mitre_attack_data.get_object_by_stix_id("intrusion-set--2a158b0a-7ef8-43cb-9985-bf34d1e12050") # G0019 print(group.aliases) # ['Naikon'] # retrieve tactic TA0001 (stix2 Custom Object) tactic = mitre_attack_data.get_object_by_attack_id("TA0001") print(tactic.name) # 'Initial Access' ``` -------------------------------- ### Retrieve Software Used by Groups Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Builds a lookup table for software used by groups, including relationship details. This is useful for understanding group-software connections. ```python from mitreattack.stix20 import MitreAttackData mitre_attack_data = MitreAttackData("enterprise-attack.json") group_id_to_software = mitre_attack_data.get_software_used_by_groups() print(group_id_to_software["intrusion-set--2a158b0a-7ef8-43cb-9985-bf34d1e12050"]) ``` -------------------------------- ### Get Analytics by Detection Strategy Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves analytic objects associated with a specific detection strategy. ```APIDOC ## get_analytics_by_detection_strategy(detection_strategy_stix_id: str, remove_revoked_deprecated: bool = False) ### Description Retrieve analytics for a detection strategy. ### Parameters * **detection_strategy_stix_id** (*str*) – Detection Strategy to search. * **remove_revoked_deprecated** (*bool* *,* *optional*) – Remove revoked or deprecated objects from the query, by default False. ### Returns A list of Analytic objects referenced by the given detection strategy. ### Return type list[Analytic] ### Raises **ValueError** – If no detection strategy with the given STIX ID is found. ``` -------------------------------- ### Preview ATT&CK Version Update Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/RELEASE.md Previews the update to release information for a new ATT&CK version without applying changes. Requires 'dev' extra for uv. ```bash uv run --extra dev python scripts/update_release_info.py 19.1 --dry-run ``` -------------------------------- ### Get Parent Technique of Sub-technique Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Identifies the parent technique for a given sub-technique using its STIX ID. ```APIDOC ## get_parent_technique_of_subtechnique(subtechnique_stix_id: str) ### Description Get the parent technique of a sub-technique. ### Parameters #### Path Parameters - **subtechnique_stix_id** (str) - Required - The STIX ID of the sub-technique. ### Returns - List of RelationshipEntry[Technique] describing the parent technique of the sub-technique. - Return type: list[RelationshipEntry[Technique]] ``` -------------------------------- ### Build Excel for All ATT&CK Domains from a Release Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/attackToExcel/README.md Exports Excel files for all ATT&CK domains from a specified release version. The tool will download STIX files temporarily if they are missing. ```shell attack-to-excel from-release --version v19.0 ``` -------------------------------- ### Get Data Sources Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves all data source objects. Optionally filters out revoked or deprecated objects. ```APIDOC ## get_datasources ### Description Retrieve all data source objects. Optionally remove revoked or deprecated objects. ### Parameters #### Query Parameters - **remove_revoked_deprecated** (bool) - Optional - Remove revoked or deprecated objects from the query, by default False. ### Returns - A list of DataSource objects. ### Return type list[DataSource] ``` -------------------------------- ### Get Data Components Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves all data component objects. Optionally filters out revoked or deprecated objects. ```APIDOC ## get_datacomponents ### Description Retrieve all data component objects. Optionally remove revoked or deprecated objects. ### Parameters #### Query Parameters - **remove_revoked_deprecated** (bool) - Optional - Remove revoked or deprecated objects from the query, by default False. ### Returns - A list of DataComponent objects. ### Return type list[DataComponent] ``` -------------------------------- ### Get Campaigns Using Technique Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves all campaigns that use a specific technique, identified by its STIX ID. ```APIDOC ## get_campaigns_using_technique ### Description Get all campaigns using a technique. ### Parameters #### Path Parameters - **technique_stix_id** (str) - Required - The STIX ID of the technique. ### Returns - List of RelationshipEntry[Campaign] for each campaign using the technique. ### Return type list[RelationshipEntry[Campaign]] ``` -------------------------------- ### get_all_campaigns_using_all_software Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves a mapping of all software to the campaigns that use it. ```APIDOC ## get_all_campaigns_using_all_software ### Description Get all campaigns using all software. ### Method GET ### Endpoint /software/campaigns ### Parameters #### Path Parameters None #### Query Parameters None #### Request Body None ### Returns Mapping of software_stix_id to RelationshipEntry[Campaign] for each campaign using the software. ### Return type RelationshipMapT[Campaign] ``` -------------------------------- ### Get Campaigns Attributed to Group Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves all campaigns that are attributed to a specific group, identified by its STIX ID. ```APIDOC ## get_campaigns_attributed_to_group ### Description Get all campaigns attributed to a group. ### Parameters #### Path Parameters - **group_stix_id** (str) - Required - The STIX ID of the group. ### Returns - List of RelationshipEntry[Campaign] for each campaign attributed to the group. ### Return type list[RelationshipEntry[Campaign]] ``` -------------------------------- ### Get Assets Targeted by Technique Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves all assets that are targeted by a specific technique, identified by its STIX ID. ```APIDOC ## get_assets_targeted_by_technique ### Description Get all assets targeted by a technique. ### Parameters #### Path Parameters - **technique_stix_id** (str) - Required - The STIX ID of the technique. ### Returns - List of RelationshipEntry[Asset] for each asset targeted by the technique. ### Return type list[RelationshipEntry[Asset]] ``` -------------------------------- ### Download All ATT&CK STIX Bundles Source: https://github.com/mitre-attack/mitreattack-python/blob/main/examples/README.md Use the download_attack_stix CLI command to download all available ATT&CK releases in STIX format. The bundles will be saved to the default directory (attack-releases). ```sh download_attack_stix --all ``` -------------------------------- ### Command Line Tools Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/navlayers/README.md Command-line utilities for layer export and generation. ```APIDOC ## layerExporter_cli.py ### Description A commandline utility to export Layer files to excel or svg formats using the exporter tools. Run with `-h` for usage. ## layerGenerator_cli.py ### Description A commandline utility to generate Layer files that correspond to various and collections of various stix objects. Run with `-h` for usage. ``` -------------------------------- ### get_name Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Get the name of a STIX object given its STIX ID. Returns None if the object or name is not present. ```APIDOC ## get_name ### Description Get the name of a STIX object given its STIX ID. Returns None if the object or name is not present. ### Parameters - **stix_id** (str) - The STIX ID of the object. ### Returns The value of the ‘name’ property of the STIX object, or None if not present. ### Return type str | None ``` -------------------------------- ### Get ATT&CK ID Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves the ATT&CK ID for a given object's STIX ID. ```APIDOC ## get_attack_id ### Description Get the object’s ATT&CK ID. ### Parameters #### Path Parameters - **stix_id** (str) - Required - The STIX ID of the object. ### Returns - The ATT&CK ID of the object, or None if not found. ### Return type str | None ``` -------------------------------- ### Initialize ToExcel Exporter Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/navlayers/README.md Instantiate the ToExcel class with specified domain, data source, and resource. The 'source' parameter determines whether to use local STIX data or a remote ATT&CK Workbench instance. ```python x = ToExcel(domain='enterprise', source='local', resource=None) ``` -------------------------------- ### Get Detection Strategies Detecting Technique Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves all detection strategies that detect a specific technique, identified by its STIX ID. ```APIDOC ## get_detection_strategies_detecting_technique ### Description Get all detection strategies detecting a technique. ### Parameters #### Path Parameters - **technique_stix_id** (str) - Required - The STIX ID of the technique. ### Returns - List of RelationshipEntry[DetectionStrategy] for each detection strategy detecting the technique. ### Return type list[RelationshipEntry[DetectionStrategy]] ``` -------------------------------- ### Initialize UsageLayerGenerator Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/navlayers/README.md Initializes the UsageLayerGenerator with data source, domain, and resource path. The source can be 'local' or 'remote'. Resource is required for 'local' (bundle path) or 'remote' (Workbench URL). ```python x = UsageLayerGenerator(source='local', domain='enterprise', resource=None) ``` -------------------------------- ### Initialize BatchGenerator Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/navlayers/README.md Initializes the BatchGenerator with data source, domain, and resource path. Similar to UsageLayerGenerator, it supports 'local' and 'remote' sources and requires a resource path for local bundles or remote Workbench URLs. ```python x = BatchGenerator(source='local', domain='enterprise', resource=None) ``` -------------------------------- ### Get Data Components Detecting Technique Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves all data components that detect a specific technique, identified by its STIX ID. ```APIDOC ## get_datacomponents_detecting_technique ### Description Get all data components detecting a technique. ### Parameters #### Path Parameters - **technique_stix_id** (str) - Required - The STIX ID of the technique. ### Returns - List of RelationshipEntry[DataComponent] describing the data components that can detect the technique. ### Return type list[RelationshipEntry[DataComponent]] ``` -------------------------------- ### layerExporter_cli Help Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/navlayers/README.md Displays the help message for the layerExporter_cli tool, outlining available commands and options for exporting ATT&CK Navigator layer files. ```commandline C:\Users\attack>layerExporter_cli -h usage: layerExporter_cli [-h] -m {svg,excel} [-s {local,remote}] [--resource RESOURCE] -o OUTPUT [OUTPUT ...] [-l LOAD_SETTINGS] [-d WIDTH HEIGHT] input [input ...] Export an ATT&CK Navigator layer as a svg image or excel file positional arguments: input Path(s) to the file to export optional arguments: -h, --help show this help message and exit -m {svg,excel}, --mode {svg,excel} The form to export the layers in -s {local,remote}, --source {local,remote} What source to utilize when building the matrix --resource RESOURCE Path to the local resource if --source=local, or url of an ATT&CK Workbench instance if --source=remote -o OUTPUT [OUTPUT ...], --output OUTPUT [OUTPUT ...] Path(s) to the exported svg/xlsx file -l LOAD_SETTINGS, --load_settings LOAD_SETTINGS [SVG Only] Path to a SVG configuration json to use when rendering -d WIDTH HEIGHT, --size WIDTH HEIGHT [SVG Only] X and Y size values (in inches) for SVG export (use -l for other settings) ``` -------------------------------- ### layerGenerator_cli Help Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/navlayers/README.md Displays the help message for the layerGenerator_cli tool, detailing options for generating ATT&CK Navigator layer files based on groups, software, mitigations, or data sources. ```commandline C:\Users\attack>layerGenerator_cli -h usage: layerGenerator_cli [-h] (--overview-type {group,software,mitigation,datasource} | --mapped-to MAPPED_TO | --batch-type {group,software,mitigation,datasource}) [-o OUTPUT] [--domain {enterprise,mobile,ics}] [--source {local,remote}] [--resource RESOURCE] Generate an ATT&CK Navigator layer optional arguments: -h, --help show this help message and exit --overview-type {group,software,mitigation,datasource} Output a layer file where the target type is summarized across the entire dataset. --mapped-to MAPPED_TO Output layer file with techniques mapped to the given group, software, mitigation, or data component. Argument can be name, associated group/software, or ATT&CK ID. --batch-type {group,software,mitigation,datasource} Output a collection of layer files to the specified folder, each one representing a different instance of the target type. -o OUTPUT, --output OUTPUT Path to the output layer file/directory --domain {enterprise,mobile,ics} Which domain to build off of --source {local,remote} What source to utilize when building the layer files --resource RESOURCE Path to the local resource if --source=local, or url of an ATT&CK Workbench instance if --source=remote ``` -------------------------------- ### Technique Object Properties and Methods Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/navlayers/core/README.md Represents a single ATT&CK technique within a layer. Use its properties to set scores, comments, and display options. The get_dict() method exports the technique's data. ```python Technique().techniqueID Technique().tactic Technique().comment Technique().enabled Technique().score Technique().aggregateScore Technique().color Technique().metadata Technique().showSubtechniques Technique().get_dict() ``` -------------------------------- ### Utility Modules Source: https://github.com/mitre-attack/mitreattack-python/blob/main/mitreattack/navlayers/README.md Utility scripts for exporting ATT&CK data into various formats. ```APIDOC ## excel_templates ### Description Provides a means by which to convert a matrix into a clean excel matrix template. ## matrix_gen ### Description Provides a means by which to generate a matrix from raw data, either from a local STIX Bundle or from an ATT&CK Workbench instance (via url). ## svg_templates ### Description Provides a means by which to convert a layer file into a marked up svg file. ## svg_objects ### Description Provides raw templates and supporting functionality for generating svg objects. ``` -------------------------------- ### get_all_datacomponents_detecting_all_techniques Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/mitre_attack_data/mitre_attack_data.md Retrieves a mapping of all techniques to the data components that can detect them. ```APIDOC ## get_all_datacomponents_detecting_all_techniques ### Description Get all data components detecting all techniques. ### Method GET ### Endpoint /techniques/datacomponents ### Parameters #### Path Parameters None #### Query Parameters None #### Request Body None ### Returns Mapping of technique_stix_id to RelationshipEntry[DataComponent] describing the data components that can detect the technique. ### Return type RelationshipMapT[[DataComponent](custom_objects.md#mitreattack.stix20.DataComponent)] ``` -------------------------------- ### Apply ATT&CK Version Update Source: https://github.com/mitre-attack/mitreattack-python/blob/main/docs/RELEASE.md Applies the update to release information for a new ATT&CK version. Requires 'dev' extra for uv. ```bash uv run --extra dev python scripts/update_release_info.py 19.1 ```