Does it support the latest MITRE ATT&CK version?

Yes, the skill is designed to work with current STIX/TAXII data sources and generates JSON layers compatible with Navigator format v4.5 and above.

How does it help with detection engineering?

It identifies 'gaps' by overlaying known threat actor TTPs with your current detection capabilities, highlighting exactly which techniques lack monitoring or logs.

Can I use this for cloud-based threat actors?

Yes, the skill supports the Enterprise-attack matrix which includes platforms like Azure AD, Office 365, SaaS, and Google Workspace.

What libraries are required for this skill?

This skill requires Python 3.9+ along with the attackcti, mitreattack-python, stix2, and requests libraries to fetch and process ATT&CK data.

Do I need a local instance of MITRE Navigator?

No, it generates standard JSON files that can be uploaded to the official web-based MITRE ATT&CK Navigator or any local deployment.

APT Analysis with MITRE Navigator

Name: APT Analysis with MITRE Navigator
Author: micsapp

bymicsapp

0•

セキュリティとテスト

Generates MITRE ATT&CK Navigator heatmaps and detection gap analysis reports for Advanced Persistent Threat (APT) groups.

This skill empowers security analysts to programmatically query ATT&CK data and visualize threat actor TTPs through the MITRE ATT&CK Navigator. It facilitates complex tasks such as comparing multiple APT groups, identifying security monitoring gaps, and creating actionable intelligence reports for detection engineering. By automating the mapping of intrusion sets to the Enterprise matrix, it helps organizations prioritize defensive investments based on real-world adversary behavior and documented TTPs.

主な機能

01Automated querying of ATT&CK data via TAXII and STIX servers

020 GitHub stars

03Detection gap analysis mapping internal coverage to actor techniques

04Multi-layer comparison between different threat actor profiles

05Generation of Navigator layer JSON files for TTP visualization

06Tactic-by-tactic breakdown of adversary behaviors and sub-techniques

ユースケース

01Prioritizing detection engineering efforts by identifying unmonitored high-risk TTPs

02Creating threat-informed defense reports and visualizations for technical stakeholders

03Conducting post-incident analysis to map observed adversary behavior to the MITRE framework

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills analyzing-apt-group-with-mitre-navigator

For use in Claude.ai and ChatGPT

主な機能

01Automated querying of ATT&CK data via TAXII and STIX servers

020 GitHub stars

03Detection gap analysis mapping internal coverage to actor techniques

04Multi-layer comparison between different threat actor profiles

05Generation of Navigator layer JSON files for TTP visualization

06Tactic-by-tactic breakdown of adversary behaviors and sub-techniques

ユースケース

01Prioritizing detection engineering efforts by identifying unmonitored high-risk TTPs

02Creating threat-informed defense reports and visualizations for technical stakeholders

03Conducting post-incident analysis to map observed adversary behavior to the MITRE framework

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills analyzing-apt-group-with-mitre-navigator

For use in Claude.ai and ChatGPT