attackcti Python Library

The attackcti module provides a Pythonic way to access up-to-date MITRE ATT&CK content. It retrieves content available in STIX format via a public TAXII server.

This client is built upon the official MITRE-developed libraries:

• cti-python-stix2
• cti-taxii-client

It is designed to help security analysts explore ATT&CK content, integrate the framework into other platforms, and transition from the legacy ATT&CK MediaWiki API to the modern STIX/TAXII 2.0 API.

You can install the attackcti package using pip or by cloning the repository and installing it locally.

Via pip

pip install attackcti

Via source installation

git clone https://github.com/OTRF/ATTACK-Python-Client
cd ATTACK-Python-Client
pip install .

The modern detection model in this client follows a specific hierarchical structure that you can traverse to map techniques to specific data requirements:

Technique $\rightarrow$ Detection Strategy $\rightarrow$ Analytic $\rightarrow$ Log Source References $\rightarrow$ Data Components

When iterating through the enriched data, you can access these levels via the following keys:

• Technique: x_attackcti_detection_strategies
• Strategy: x_attackcti_analytics
• Analytic: x_attackcti_log_sources
• Log Source: x_mitre_data_component_ref (ID) or x_attackcti_data_component (Full Object)

Once a MitreAttackClient is initialized, you can access specific ATT&CK domains through dedicated subclient properties. These subclients provide the interface for interacting with data in that specific domain.

Available Subclients

• enterprise: Access Enterprise ATT&CK data.
• mobile: Access Mobile ATT&CK data.
• ics: Access ICS ATT&CK data.
• query: Provides a QueryClient for cross-domain queries using a composite data source.

from attackcti import MitreAttackClient

client = MitreAttackClient.from_taxii()

# Accessing subclients (these are lazily instantiated)
enterprise_data = client.enterprise
mobile_data = client.mobile
ics_data = client.ics
query_engine = client.query

The data returned by attackcti functions is of type stix2. To use this data with libraries like Pandas, you must first serialize the objects and convert them into standard Python dictionaries using json.loads(obj.serialize()).

import json
import pandas

# Assuming 'techniques' is the list returned by lift.get_techniques()
all_techniques = []
for t in techniques:
    all_techniques.append(json.loads(t.serialize()))

df = pandas.json_normalize(all_techniques)

If you prefer to install from the source repository, clone the repository and run pip install . from the root directory.

git clone https://github.com/OTRF/ATTACK-Python-Client
cd ATTACK-Python-Client
pip install .

To use the attack-python-client with local STIX JSON files instead of querying a remote API, provide a dictionary mapping domain names to their respective local file paths via the local_paths argument in the MitreAttackClient constructor.

Supported domain keys typically include:

• enterprise
• mobile
• ics

local_paths = {
    'enterprise': '.attackcti/stix-2.1/v18.1/enterprise-attack.json',
    'mobile': '.attackcti/stix-2.1/v18.1mobile-attack.json',
    'ics': '.attackcti/stix-2.1/v18.1ics-attack.json'
}

from attackcti import MitreAttackClient

# Initialize the client using the local file paths
lift = MitreAttackClient(local_paths=local_paths)

Use the STIXDownloader class from attackcti.utils.downloader to download MITRE ATT&CK STIX data for specific domains and releases. You can specify the target directory and the STIX version (e.g., "2.0" or "2.1") during initialization.

To download data for a specific domain (like "enterprise" or "mobile"), use the download_attack_data method with the domain and release arguments.

from attackcti.utils.downloader import STIXDownloader

# Initialize for STIX 2.0
stix20_downloader = STIXDownloader(download_dir="./downloads", stix_version="2.0")
stix20_downloader.download_attack_data(domain="enterprise", release="16.1")

# Initialize for STIX 2.1
stix21_downloader = STIXDownloader(download_dir="./downloads", stix_version="2.1")
stix21_downloader.download_attack_data(domain="mobile", release="16.1")

To interact with and query the downloaded STIX files, use the STIXStore class from attackcti.utils.storage.

1. Initialize STIXStore by passing the path to a downloaded STIX file.
2. Use the .source.query() method to search for specific STIX objects. This method accepts a list of stix2.Filter objects.

from attackcti.utils.storage import STIXStore
from stix2 import Filter

# Initialize store with a downloaded file path
store = STIXStore(stix21_downloader.downloaded_file_path)

# Query for specific objects (e.g., attack-patterns)
filters = [Filter("type", "=", "attack-pattern")]
techniques = store.source.query(filters)

You can install the attackcti package using pip or by cloning the repository and installing it locally.

Prerequisites

• Python 3+

pip install attackcti

You can interact with the MITRE ATT&CK framework by using the taxii2client.v21 library to connect to the public TAXII server.

1. Instantiate a Server object using the MITRE TAXII URL.
2. Access api_roots from the server object to find logical groupings of TAXII Channels and Collections.
3. Iterate through api_root.collections to inspect available collections, their title, description, and id.

from taxii2client.v21 import Server

# Connect to the MITRE TAXII server
server = Server("https://attack-taxii.mitre.org/taxii2/")

# Access API roots
api_root = server.api_roots[0]

# Explore collections
for collection in api_root.collections:
    print(collection.title, "->", collection.description)
    print("ID:", collection.id)