Registry / data / mitreattack-python

mitreattack-python

JSON →
library6.1.0pypypi✓ verified 83d ago

mitreattack-python is a Python library developed by MITRE for working with ATT&CK data. It provides various tools and utilities for interacting with MITRE ATT&CK STIX 2.0 content, including functionalities for handling ATT&CK Navigator layers, converting ATT&CK data to Excel spreadsheets, and managing ATT&CK Collections. The library is actively maintained and frequently updated to align with the latest versions of the ATT&CK knowledge base, typically on a quarterly release cadence.

pip install mitreattack-python
INSTALL
IMPORT
SIG · MITREATTACK-PYTHON
M
mitreattack-python
datapythonv6.1.0
Install
14.2s avg
Import
Disk
237MB
Pass rate
10/ 10
Env Coverage10 / 10
glibc
3.93.13
musl
3.93.13
Install & Compatibility
Where this runs
tested against v4.0.2 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
py 3.103.910 runs
installs and imports cleanly · install 0.0s · import 0.000s · 219.1MB
glibc
py 3.103.910 runs
installs and imports cleanly · install 14.2s · import 0.000s · 212MB
237MB installed
● package 237MB
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

attackToExcel
from mitreattack import attackToExcel
from mitreattack.MitreAttackData import MitreAttackData
collections
from mitreattack import collections
navlayers
from mitreattack import navlayers

This quickstart demonstrates how to initialize the MitreAttackData object for a specific ATT&CK domain, retrieve all techniques, and fetch a specific technique by its ATT&CK ID. It also shows how to retrieve all adversary groups.

from mitreattack.MitreAttackData import MitreAttackData # Initialize with a specific domain (e.g., 'enterprise-attack', 'mobile-attack', 'ics-attack') # The data will be downloaded and cached locally if not present. attack_data = MitreAttackData("enterprise-attack") # Get all techniques techniques = attack_data.get_techniques() print(f"Found {len(techniques)} Enterprise ATT&CK techniques.") # Get a specific technique by ATT&CK ID spec_technique = attack_data.get_techniques_by_attack_id("T1566.001") if spec_technique: print(f"\nSpecific Technique: {spec_technique[0].name} (ID: {spec_technique[0].attack_id})") # Get all groups groups = attack_data.get_groups() print(f"\nFound {len(groups)} Enterprise ATT&CK groups.")
Debug
Known issues
breakingVersion 5.0.0 and above of `mitreattack-python` requires Python 3.11 or newer. Projects running on older Python versions must upgrade or stick to `mitreattack-python` < 5.0.0.
fix
Upgrade your Python environment to 3.11+ or constrain `mitreattack-python` to `<5.0.0` in your `requirements.txt`.
affects: >=5.0.0
breakingWith the October 2025 (v18) ATT&CK release, the underlying STIX schema for detections has changed significantly. 'Data Sources' and 'Data Components' are largely deprecated in favor of new 'Detection Strategies' and 'Analytics' objects. This impacts functions in modules like `diffStix` and methods interacting with detection-related data.
fix
Review the official ATT&CK Data Model documentation for v18.0 and above. Update custom code that processes Data Sources/Components to utilize the new Detection Strategies and Analytics objects. Ensure your `mitreattack-python` version is up-to-date (>=5.4.0) to correctly parse the latest ATT&CK STIX data.
affects: >=5.4.0 (for full support of v18 data), potentially earlier versions when processing v18 data
gotchaWhen querying ATT&CK data, it's highly recommended to filter out 'revoked' and 'deprecated' objects as they are no longer actively maintained by MITRE. Not doing so can lead to unexpected results or outdated information.
fix
Utilize the `remove_revoked_deprecated=True` parameter in relevant `MitreAttackData` methods (e.g., `get_techniques(remove_revoked_deprecated=True)`).
affects: All versions
Upgrade
Version history
6.1.0latest on PyPI · released May 12, 2026
Audit
Dependencies
stix2requiredCore for handling STIX 2.x formatted cyber threat intelligence data.
pandasoptionalUsed by the attackToExcel module for data manipulation and DataFrame exports.
openpyxloptionalUsed by the attackToExcel module for generating Excel files.
typerrequiredUsed for building command-line interfaces for various utility scripts.
Agent activity
15 hits · last 30 days
node
14
OpenAI (training)
1
Resources
mitreattack-python — pip install mitreattack-python · libregistry