← LeaderboardThe Skill Leaderboard

analyzing-threat-actor-ttps-with-mitre-navigator

Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles. Use when profiling an APT group's techniques, building Navigator coverage heatmaps, or assessing technique coverage gaps against a specific threat actor.

Published by mukul975 ↗mukul975/Anthropic-Cybersecurity-Skills

Try your first task

Start a fresh conversation. Replace the highlighted placeholders.

Use analyzing-threat-actor-ttps-with-mitre-navigator to map [threat group] to ATT&CK techniques, overlay [detection coverage], and export a Navigator layer that highlights defensive gaps; require the documented ATT&CK libraries and Navigator access.

Required inputs

[threat group]
[detection coverage]

User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗

SKILL.md

name: analyzing-threat-actor-ttps-with-mitre-navigatordescription: 'Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles. Use when profiling an APT group''s techniques, building Navigator coverage heatmaps, or assessing technique coverage gaps against a specific threat actor.  'domain: cybersecuritysubdomain: threat-intelligencetags: - mitre-attack- navigator- threat-intelligence- apt- ttp-mapping- stix- attackctiversion: '1.0'author: mahipallicense: Apache-2.0nist_ai_rmf: - MEASURE-2.7- MAP-5.1- MANAGE-2.4atlas_techniques: - AML.T0070- AML.T0066- AML.T0082d3fend_techniques: - File Metadata Consistency Validation- Application Protocol Command Analysis- Identifier Analysis- Content Format Conversion- Message Analysisnist_csf: - ID.RA-01- ID.RA-05- DE.CM-01- DE.AE-02mitre_attack: - T1566.001- T1059.001- T1071.001- T1547.001- T1053.005

Analyzing Threat Actor TTPs with MITRE Navigator

Overview

The MITRE ATT&CK Navigator is a web application for annotating and visualizing ATT&CK matrices. Combined with the attackcti Python library (which queries ATT&CK STIX data via TAXII), analysts can programmatically generate Navigator layer files mapping specific threat group TTPs, compare multiple groups, and assess detection coverage gaps against known adversaries.

When to Use

When investigating security incidents that require analyzing threat actor ttps with mitre navigator
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Python 3.8+ with attackcti and stix2 libraries installed
MITRE ATT&CK Navigator (web UI or local instance)
Understanding of STIX 2.1 objects and relationships

Steps

Query ATT&CK STIX data for target threat group using attackcti
Extract techniques associated with the group via STIX relationships
Generate ATT&CK Navigator layer JSON with technique annotations
Overlay detection coverage to identify gaps
Export layer for team review and defensive planning

Expected Output

{
  "name": "APT29 TTPs",
  "domain": "enterprise-attack",
  "techniques": [
    {"techniqueID": "T1566.001", "score": 1, "comment": "Spearphishing Attachment"},
    {"techniqueID": "T1059.001", "score": 1, "comment": "PowerShell"}
  ]
}