Predict MITRE Transitions
predict_mitre_transitionsPredict MITRE ATT&CK techniques likely to follow or precede a given technique, with probabilities and example threats. Use forward to anticipate the next step, or reverse to infer what came before.
Instructions
Predict the MITRE ATT&CK techniques most likely to follow (or precede) a given technique, with probabilities and example threats. Each row carries order_basis: 'attack_flow' rows come from analyst-authored ATT&CK Flow DAGs (real asserted causality), 'mitre_canonical' rows are inferred by sorting a threat's flat technique set by canonical tactic rank, and 'blended' rows have both. Prefer attack_flow evidence: ~24% of real transitions run against canonical tactic order and are inexpressible by the canonical basis. Use forward to anticipate the next step; reverse to infer what came before.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| basis | No | Filter by evidence basis. Default 'any' (unfiltered, byte-identical to previous behaviour). Use 'attack_flow' for authored-causality rows only. | |
| top_n | No | Max transitions to return (default 5, max 20) | |
| direction | No | 'forward' = techniques that typically follow (default); 'reverse' = techniques that typically precede | |
| technique_id | No | Source technique ID (e.g. T1059 or T1059.001) |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | ||
| total | No | ||
| direction | No | ||
| transitions | No | ||
| technique_id | Yes |