About

Imported from mukul975/anthropic-cybersecurity-skills (skills/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill analyzing-threat-actor-ttps-with-mitre-navigator. Copyright stays with the author (Apache-2.0).

Analyzing Threat Actor TTPs with MITRE Navigator

Name: analyzing-threat-actor-ttps-with-mitre-navigator
Author: mukul975

Overview

The MITRE ATT&CK Navigator is a web application for annotating and visualizing ATT&CK matrices. Combined with the attackcti Python library (which queries ATT&CK STIX data via TAXII), analysts can programmatically generate Navigator layer files mapping specific threat group TTPs, compare multiple groups, and assess detection coverage gaps against known adversaries.

When to Use

When investigating security incidents that require analyzing threat actor ttps with mitre navigator
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Python 3.8+ with attackcti and stix2 libraries installed
MITRE ATT&CK Navigator (web UI or local instance)
Understanding of STIX 2.1 objects and relationships

Steps

Query ATT&CK STIX data for target threat group using attackcti
Extract techniques associated with the group via STIX relationships
Generate ATT&CK Navigator layer JSON with technique annotations
Overlay detection coverage to identify gaps
Export layer for team review and defensive planning

Expected Output

{
  "name": "APT29 TTPs",
  "domain": "enterprise-attack",
  "techniques": [
    {"techniqueID": "T1566.001", "score": 1, "comment": "Spearphishing Attachment"},
    {"techniqueID": "T1059.001", "score": 1, "comment": "PowerShell"}
  ]
}

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mukul975-anthropic-cybersecurity-skills-analyzing-threat-5d1145/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mukul975-anthropic-cybersecurity-skills-analyzing-threat-5d1145.ocm.jsonjson

{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-analyzing-threat-5d1145",
  "kind": "skill",
  "name": "analyzing-threat-actor-ttps-with-mitre-navigator",
  "description": "Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles. Use when profiling an APT group's techniques, building Navigator coverage heatmaps, or assessing technique coverage gaps against a specific threat actor.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "data_analysis",
      "coding"
    ],
    "tags": [
      "skill-md",
      "mitre-attack",
      "navigator",
      "threat-intelligence",
      "apt",
      "ttp-mapping",
      "stix",
      "attackcti",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles. Use when profiling an APT group's techniques, building Navigator coverage heatmaps, or assessing technique coverage gaps against a specific threat actor."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Analyzing Threat Actor TTPs with MITRE Navigator\n\n## Overview\n\nThe MITRE ATT&CK Navigator is a web application for annotating and visualizing ATT&CK matrices.\nCombined with the attackcti Python library (which queries ATT&CK STIX data via TAXII), analysts\ncan programmatically generate Navigator layer files mapping specific threat group TTPs, compare\nmultiple groups, and assess detection coverage gaps against known adversaries.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing threat actor ttps with mitre navigator\n- When building detection rules or threat huntin",
  "cost": {
    "context_tokens": 386
  }
}

Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-analyzing-threat-5d1145/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.