building-attack-pattern-library-from-cti-reports - Build ATT&CK Attack Pattern Libraries from CTI Reports
Parse CTI reports, map adversary behaviors to MITRE ATT&CK techniques, create a searchable STIX 2.1 attack-pattern library, and generate detection templates.
Tags
Updated: 2026-09-28Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Parse CTI reports
- Extract adversary behaviors
- Map ATT&CK technique IDs
- Create STIX 2.1 patterns
- Index attack pattern libraries
- Generate Sigma/YARA templates
Inputs
- CTI reports
- MITRE ATT&CK STIX data
- Report source metadata
Outputs
- ATT&CK technique mappings
- STIX 2.1 attack-pattern objects
- Searchable attack-pattern library
- Sigma/YARA detection templates
Requirements
- Python 3.9 or later
- stix2 library
- mitreattack-python library
- spaCy library
- requests library