Threat Actor TTP Navigator Mapping
Map a threat group's ATT&CK techniques and build Navigator heatmap layers to check defensive coverage gaps.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
Once installed, the agent can look up a named cyber threat group (such as an APT actor) in the MITRE ATT&CK knowledge base, list the attack techniques that group is known to use, and produce a JSON layer file that can be opened in the MITRE ATT&CK Navigator web app to color-code those techniques. Security teams can use the result to compare the group's behaviour against their own detection coverage and spot gaps. The skill is a set of instructions plus a Python helper script that queries ATT&CK data through the attackcti library.
Great for
- SOC analysts and threat intelligence teams profiling a specific APT group before a review or exercise
- Security engineers who want to compare detection coverage against a named adversary
- Students learning how ATT&CK, STIX data and Navigator layers fit together
Skip it if
- Real-time incident response, since it relies on a static ATT&CK snapshot and is not a live threat feed (the output is only as current as the data pulled)
- Anyone expecting verified coverage scores: the layer reflects known group-technique associations, not whether your own controls actually detect them
- Non-security users, because the output requires understanding of ATT&CK terminology to interpret correctly
Try asking
- “Profile APT29 and generate an ATT&CK Navigator layer file of its techniques”
- “Compare the techniques of two threat groups and build a combined coverage heatmap”
- “List all threat groups in ATT&CK with their IDs and aliases”
- “Identify which techniques used by a named group are not covered by our current detection rules”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
analyzing-threat-actor-ttps-with-mitre-navigator.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-threat-actor-ttps-with-mitre-navigator.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-threat-actor-ttps-with-mitre-navigator.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Review scripts/agent.py before running it, and run it in a virtual environment with the listed Python packages installed
- Ask for a specific group name or alias (e.g. APT29 or Cozy Bear) so the agent can match it in the ATT&CK data
- Treat the generated layer as a starting point and verify technique mappings against the original ATT&CK group pages before reporting
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.