Microproduct data guideintermediate

MITRE ATT&CK Enterprise Knowledge Base

Versioned adversary tactics, techniques, software, groups, mitigations, and relationships for building threat-model and detection-coverage tools.

Start the guide Open official source

At a glance

Difficulty
Intermediate — some data preparation helps
Size
Small · ≤0.1 GB
Formats
STIX JSON, XLSX
Access
API or Download
API key
Not required
Provider
MITRE
Updates
Occasional
Data terms
MITRE ATT&CK terms of use

From source to product signal

Test a product idea in four steps

Enterprise ATT&CK represents documented adversary behaviors and their relationships in STIX. Start with attack-pattern objects and their tactic phases. ATT&CK is a knowledge base, not a measure of behavior prevalence or proof that a mapped control detects every implementation of a technique.

1

Check the setup

  • Python 3.10 or newer
  • A notebook environment such as Jupyter or Google Colab
  • An internet connection
2

Access the data

  1. 1.Open the ATT&CK data page and note the current Enterprise release.
  2. 2.Download the official Enterprise STIX bundle from MITRE's data repository.
  3. 3.Retain object identifiers, versions, revoked flags, and source citations.
Open official source
3

Run the Python example

Install the packages, then run the notebook cell.

python -m pip install pandas requests

import pandas as pd
import requests

url = "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json"
response = requests.get(url, timeout=30)
response.raise_for_status()
objects = response.json()["objects"]
techniques = pd.json_normalize([
    item for item in objects
    if item.get("type") == "attack-pattern" and not item.get("revoked", False)
])
print(techniques[["id", "name", "x_mitre_version"]].head(20))
4

Test a useful signal

Build an Enterprise tactic-to-technique matrix

Count current Enterprise techniques by tactic and identify areas needing deeper coverage review.

  1. 01Filter to current non-revoked attack-pattern objects and expand their kill-chain phases.
  2. 02Count techniques by tactic while retaining technique identifiers and version fields.
  3. 03Explain why technique counts do not measure prevalence or guarantee detection effectiveness.

Dataset details

MITRE is a nonprofit source. Last verified 2026-08-13. Temporal coverage: current versioned knowledge base.

Theme

Technology & Cybersecurity

Domains

CybersecurityThreat Intelligence

Data types

Knowledge GraphTaxonomy

Tasks

Threat ModelingCoverage AnalysisKnowledge Graph Analysis

Geography

Global

Formats

STIX JSONXLSX

Provider

MITRE

Data terms

MITRE ATT&CK terms of use