Install & Compatibility
Where this runs
tested against v4.0.2 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.910 runs
installs and imports cleanly · install 0.0s · import 0.000s · 219.1MB
glibcpy 3.10–3.910 runs
installs and imports cleanly · install 14.2s · import 0.000s · 212MB
237MB installed
● package 237MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
attackToExcel
✓ from mitreattack import attackToExcel
✗ from mitreattack.MitreAttackData import MitreAttackData
collections
✓ from mitreattack import collections
navlayers
✓ from mitreattack import navlayers
This quickstart demonstrates how to initialize the MitreAttackData object for a specific ATT&CK domain, retrieve all techniques, and fetch a specific technique by its ATT&CK ID. It also shows how to retrieve all adversary groups.
from mitreattack.MitreAttackData import MitreAttackData
# Initialize with a specific domain (e.g., 'enterprise-attack', 'mobile-attack', 'ics-attack')
# The data will be downloaded and cached locally if not present.
attack_data = MitreAttackData("enterprise-attack")
# Get all techniques
techniques = attack_data.get_techniques()
print(f"Found {len(techniques)} Enterprise ATT&CK techniques.")
# Get a specific technique by ATT&CK ID
spec_technique = attack_data.get_techniques_by_attack_id("T1566.001")
if spec_technique:
print(f"\nSpecific Technique: {spec_technique[0].name} (ID: {spec_technique[0].attack_id})")
# Get all groups
groups = attack_data.get_groups()
print(f"\nFound {len(groups)} Enterprise ATT&CK groups.")
Debug
Known issues
breakingVersion 5.0.0 and above of `mitreattack-python` requires Python 3.11 or newer. Projects running on older Python versions must upgrade or stick to `mitreattack-python` < 5.0.0.fixUpgrade your Python environment to 3.11+ or constrain `mitreattack-python` to `<5.0.0` in your `requirements.txt`.
affects: >=5.0.0
breakingWith the October 2025 (v18) ATT&CK release, the underlying STIX schema for detections has changed significantly. 'Data Sources' and 'Data Components' are largely deprecated in favor of new 'Detection Strategies' and 'Analytics' objects. This impacts functions in modules like `diffStix` and methods interacting with detection-related data.fixReview the official ATT&CK Data Model documentation for v18.0 and above. Update custom code that processes Data Sources/Components to utilize the new Detection Strategies and Analytics objects. Ensure your `mitreattack-python` version is up-to-date (>=5.4.0) to correctly parse the latest ATT&CK STIX data.
affects: >=5.4.0 (for full support of v18 data), potentially earlier versions when processing v18 data
gotchaWhen querying ATT&CK data, it's highly recommended to filter out 'revoked' and 'deprecated' objects as they are no longer actively maintained by MITRE. Not doing so can lead to unexpected results or outdated information.fixUtilize the `remove_revoked_deprecated=True` parameter in relevant `MitreAttackData` methods (e.g., `get_techniques(remove_revoked_deprecated=True)`).
affects: All versions
Upgrade
Version history
6.1.0latest on PyPI · released May 12, 2026
Audit
Dependencies
stix2requiredCore for handling STIX 2.x formatted cyber threat intelligence data.
pandasoptionalUsed by the attackToExcel module for data manipulation and DataFrame exports.
openpyxloptionalUsed by the attackToExcel module for generating Excel files.
typerrequiredUsed for building command-line interfaces for various utility scripts.