| cti-attack-mapper |
| Copyright 2026 Varol Cagdas Tok |
|
|
| Licensed under the Apache License, Version 2.0. |
| Full text: https://www.apache.org/licenses/LICENSE-2.0 |
|
|
| ------------------------------------------------------------------------------ |
| THIRD-PARTY ATTRIBUTION |
| ------------------------------------------------------------------------------ |
|
|
| This work contains and derives from the following: |
|
|
| 1. TRAM (Threat Report ATT&CK Mapper) |
| MITRE Center for Threat-Informed Defense |
| https://github.com/center-for-threat-informed-defense/tram |
| Licensed under the Apache License, Version 2.0. |
|
|
| The training corpus in data/build/ is derived from TRAM's |
| data/tram2-data/multi_label.json by deduplication, boilerplate removal and |
| re-splitting. No sentence text was rewritten. |
|
|
| 2. MITRE ATT&CK STIX Data |
| The MITRE Corporation |
| https://github.com/mitre-attack/attack-stix-data |
| Used under the ATT&CK Terms of Use: https://attack.mitre.org/resources/terms-of-use/ |
|
|
| Used for technique names and the keyword baseline only. No ATT&CK content is |
| redistributed in this repository; it is downloaded at build time. |
|
|
| ATT&CK(R) is a registered trademark of The MITRE Corporation. This project is |
| not affiliated with, endorsed by, or sponsored by The MITRE Corporation. |
|
|
| ------------------------------------------------------------------------------ |
| INTENDED USE |
| ------------------------------------------------------------------------------ |
|
|
| This model classifies descriptions of adversary behaviour that have already |
| been published in public threat reporting. It is intended for defensive |
| security work: threat intelligence triage, detection engineering, and |
| coverage analysis. It does not generate offensive capability. |
|
|
