NOTICE

cti-attack-mapper
Copyright 2026 Varol Cagdas Tok

Licensed under the Apache License, Version 2.0.
Full text: https://www.apache.org/licenses/LICENSE-2.0

------------------------------------------------------------------------------
THIRD-PARTY ATTRIBUTION
------------------------------------------------------------------------------

This work contains and derives from the following:

1. TRAM (Threat Report ATT&CK Mapper)
   MITRE Center for Threat-Informed Defense
   https://github.com/center-for-threat-informed-defense/tram
   Licensed under the Apache License, Version 2.0.

   The training corpus in data/build/ is derived from TRAM's
   data/tram2-data/multi_label.json by deduplication, boilerplate removal and
   re-splitting. No sentence text was rewritten.

2. MITRE ATT&CK STIX Data
   The MITRE Corporation
   https://github.com/mitre-attack/attack-stix-data
   Used under the ATT&CK Terms of Use: https://attack.mitre.org/resources/terms-of-use/

   Used for technique names and the keyword baseline only. No ATT&CK content is
   redistributed in this repository; it is downloaded at build time.

ATT&CK(R) is a registered trademark of The MITRE Corporation. This project is
not affiliated with, endorsed by, or sponsored by The MITRE Corporation.

------------------------------------------------------------------------------
INTENDED USE
------------------------------------------------------------------------------

This model classifies descriptions of adversary behaviour that have already
been published in public threat reporting. It is intended for defensive
security work: threat intelligence triage, detection engineering, and
coverage analysis. It does not generate offensive capability.