How do I install the Analyzing Threat Actor Ttps With Mitre Navigator skill?

Run npx skillmds@latest add gabrielmoreira/analyzing-threat-actor-ttps-with-mitre-navigator in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Analyzing Threat Actor Ttps With Mitre Navigator safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: docs only, executes scripts. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Analyzing Threat Actor Ttps With Mitre Navigator?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Analyzing Threat Actor Ttps With Mitre Navigator free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under Apache-2.

Who published Analyzing Threat Actor Ttps With Mitre Navigator?

gabrielmoreira (@gabrielmoreira) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Analyzing Threat Actor Ttps With Mitre Navigator by gabrielmoreira

Name: Analyzing Threat Actor Ttps With Mitre Navigator
Rating: 4.2 (5 reviews)
Author: gabrielmoreira

Analyzing Threat Actor Ttps With Mitre Navigator

Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles. Use when profiling an APT group's techniques, building Navigator coverage heatmaps, or assessing technique coverage gaps against a specific threat actor.

gabrielmoreira Updated Sep 9, 2026 17 repo stars

File contents

Analyzing Threat Actor TTPs with MITRE Navigator

Overview

The MITRE ATT&CK Navigator is a web application for annotating and visualizing ATT&CK matrices. Combined with the attackcti Python library (which queries ATT&CK STIX data via TAXII), analysts can programmatically generate Navigator layer files mapping specific threat group TTPs, compare multiple groups, and assess detection coverage gaps against known adversaries.

When to Use

When investigating security incidents that require analyzing threat actor ttps with mitre navigator
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Python 3.8+ with attackcti and stix2 libraries installed
MITRE ATT&CK Navigator (web UI or local instance)
Understanding of STIX 2.1 objects and relationships

Steps

Query ATT&CK STIX data for target threat group using attackcti
Extract techniques associated with the group via STIX relationships
Generate ATT&CK Navigator layer JSON with technique annotations
Overlay detection coverage to identify gaps
Export layer for team review and defensive planning

Expected Output

{
  "name": "APT29 TTPs",
  "domain": "enterprise-attack",
  "techniques": [
    {"techniqueID": "T1566.001", "score": 1, "comment": "Spearphishing Attachment"},
    {"techniqueID": "T1059.001", "score": 1, "comment": "PowerShell"}
  ]
}

---name: analyzing-threat-actor-ttps-with-mitre-navigatordescription: Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles. Use when profiling an APT group's techniques, building Navigator coverage heatmaps, or assessing technique coverage gaps against a specific threat actor.license: Apache-2.0---# Analyzing Threat Actor TTPs with MITRE Navigator ## Overview The MITRE ATT&CK Navigator is a web application for annotating and visualizing ATT&CK matrices. Combined with the attackcti Python library (which queries ATT&CK STIX data via TAXII), analysts can programmatically generate Navigator layer files mapping specific threat group TTPs, compare multiple groups, and assess detection coverage gaps against known adversaries. ## When to Use - When investigating security incidents that require analyzing threat actor ttps with mitre navigator - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques ## Prerequisites - Python 3.8+ with attackcti and stix2 libraries installed - MITRE ATT&CK Navigator (web UI or local instance) - Understanding of STIX 2.1 objects and relationships ## Steps 1. Query ATT&CK STIX data for target threat group using attackcti 2. Extract techniques associated with the group via STIX relationships 3. Generate ATT&CK Navigator layer JSON with technique annotations 4. Overlay detection coverage to identify gaps 5. Export layer for team review and defensive planning ## Expected Output ```json { "name": "APT29 TTPs", "domain": "enterprise-attack", "techniques": [ {"techniqueID": "T1566.001", "score": 1, "comment": "Spearphishing Attachment"}, {"techniqueID": "T1059.001", "score": 1, "comment": "PowerShell"} ] } ```

Frequently asked questions