MITRE CTI

Since ATT&CK is split into multiple domains (enterprise, mobile, ics), you can use stix2.CompositeDataSource to merge multiple individual DataSources into a single searchable object.

from stix2 import CompositeDataSource

src = CompositeDataSource()
src.add_data_sources([enterprise_attack_src, mobile_attack_src, ics_attack_src])

This repository (MITRE/CTI) provides ATT&CK and CAPEC datasets in STIX 2.0. However, if you require ATT&CK represented in STIX 2.1, you should use the attack-stix-data repository instead.

While both repositories are maintained, attack-stix-data includes quality-of-life improvements in its data model that are not present in this repository. For details on those improvements, consult the attack-stix-data USAGE documentation.

When working with ATT&CK data in Python, you must install and import the following libraries:

• stix2: For working with STIX objects programmatically.
• taxii2client: For accessing data via the TAXII server protocol.

When an object is replaced, it is marked as revoked and a revoked-by relationship is created. The source_ref is the old (revoked) object, and the target_ref is the new (active) object. Use the following pattern to find the replacement for a given STIX ID.

from stix2 import Filter

def getRevokedBy(stix_id, thesrc):
    relations = thesrc.relationships(stix_id, 'revoked-by', source_only=True)
    revoked_by = thesrc.query([
        Filter('id', 'in', [r.target_ref for r in relations]),
        Filter('revoked', '=', False)
    ])
    if revoked_by is not None:
        revoked_by = revoked_by[0]

    return revoked_by

getRevokedBy("attack-pattern--c16e5409-ee53-4d79-afdc-4099dc9292df", src)

To query CAPEC data, use the python-stix2 library. You must initialize a FileSystemSource pointing to the cloned CAPEC corpus.

Critical Requirement: When creating the FileSystemSource, you must set allow_custom=True. This is necessary because the CAPEC data contains custom STIX properties (e.g., x_capec_prerequisites) that are not part of the standard STIX 2.x specification.

To perform queries, define a Filter object and pass a list of filters to the query method. Filters passed in a list are logically AND'd together.

To programmatically query and manipulate ATT&CK data, use Python along with the stix2 and taxii2client libraries. You can access data either from local files within this repository or by connecting to the live ATT&CK TAXII server.

Note: ATT&CK has unified STIX 2.0 and 2.1 representations. For the most current schema details, refer to the ATT&CK Data Model Specification.

To always stay up to date with the evolving ATT&CK catalog, connect to the official ATT&CK TAXII server.

Domain Collection IDs:

• enterprise-attack: 95ecc380-afe9-11e4-9b6c-751b66dd541e
• mobile-attack: 2f669986-b40b-4423-b720-4396ca6a462b
• ics-attack: 02c3ef24-9cd4-48f3-a99f-b74ce24f1d34

Note: Always use taxii2client.v20 when interacting with the MITRE TAXII server.

from stix2 import TAXIICollectionSource
from taxii2client.v20 import Collection

collections = {
    "enterprise_attack": "95ecc380-afe9-11e4-9b6c-751b66dd541e",
    "mobile_attack": "2f669986-b40b-4423-b720-4396ca6a462b",
    "ics-attack": "02c3ef24-9cd4-48f3-a99f-b74ce24f1d34"
}

collection = Collection(f"https://cti-taxii.mitre.org/stix/collections/{collections['enterprise_attack']}/")
src = TAXIICollectionSource(collection)

To work with ATT&CK data in Python, it is recommended to use a virtual environment and install the stix2 and taxii2-client libraries.

Virtual Environment Setup:

• macOS/Linux: python3 -m venv env then source env/bin/activate
• Windows: py -m venv env then env/Scripts/activate.bat

Important Import Note: When using taxii2-client (version 2.0.0+) to connect to the ATT&CK TAXII 2.0 server, you must use the v20 import to avoid 406 responses. Similarly, if you need to ensure compatibility with the STIX 2.0 API instead of 2.1, use the stix2.v20 specifier.