Get full details of a specific ATT&CK technique by its ID (e.g., T1059, T1059.001)

Search ATT&CK techniques by keyword, tactic, platform, or data source

List all ATT&CK tactics in kill-chain order

Get details and all techniques under a specific tactic

Get details on a known threat group/APT including techniques and software used

Search threat groups by keyword or by technique usage

List all known threat groups with names, aliases, and brief descriptions

Get details on a known software, malware, or tool including techniques and associated groups

Search software/malware by name, keyword, technique, or type

Get details on a mitigation and all techniques it addresses

Get all mitigations applicable to a specific technique

Search mitigations by keyword

Get details on a data source and its components with detectable techniques

Analyze detection coverage based on available data sources in your environment

Map a security alert or observable to likely ATT&CK techniques with confidence scoring

Find technique overlap between threat groups for attribution assistance

Generate possible attack paths through the kill chain starting from a technique

Build a technique profile from observed techniques for campaign analysis and attribution

Get details on a known ATT&CK campaign including techniques, software, and attributed groups

List all known ATT&CK campaigns with names, dates, and brief descriptions

Search campaigns by keyword or by technique usage

Generate an ATT&CK Navigator layer JSON for visualization. Supports coverage heatmaps, group technique overlays, campaign views, and custom technique highlighting.

Force an update of the local ATT&CK data cache by re-downloading STIX bundles

Get current ATT&CK data version, freshness, and object counts

Get connection status for all configured SOC integrations (Wazuh, TheHive, Cortex, MISP)

Cross-correlate ATT&CK techniques across Wazuh alerts, TheHive cases, and MISP events to find related activity