APT Group Navigator Analysis
Map APT groups' ATT&CK techniques into Navigator heatmaps for detection-gap analysis
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
This skill teaches an AI agent to pull MITRE ATT&CK data about named threat groups (APT actors) and turn their known techniques into colored heatmap files that can be viewed in MITRE's ATT&CK Navigator web tool. The agent can compare several groups, overlay them against your own detection coverage, and point out techniques that are not yet covered. The output is a JSON layer file plus a written summary useful for threat-intel reports.
Great for
- Detection engineers checking which attacker techniques their monitoring misses
- Threat-intel analysts preparing Navigator visualizations for reports
- Security teams comparing technique overlap between several threat groups
Skip it if
- Live incident response, since it works from static ATT&CK reference data rather than your own logs (it cannot confirm an attack is happening)
- Users without security background who need a plain-language threat briefing; the output assumes ATT&CK and STIX familiarity
Try asking
- “Build an ATT&CK Navigator layer showing the techniques used by APT29 and export it as JSON”
- “Compare the techniques of APT28, APT29 and Lazarus Group and highlight the overlap”
- “Show which techniques used by a given APT group have no detection coverage in my current layer”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
analyzing-apt-group-with-mitre-navigator.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-apt-group-with-mitre-navigator.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-apt-group-with-mitre-navigator.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Point the script at a local copy of the ATT&CK JSON bundle to avoid repeated downloads and keep runs reproducible
- Review generated layer files before sharing, since the script hardcodes version metadata that may be outdated (the template references ATT&CK 14 and Navigator 4.9.1 while the workflow uses 16.1 and 5.1.0)
- Verify group G-codes and aliases against the official ATT&CK site before reporting results
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.