Everything is free and openly licensed. Model content CC-BY-4.0, code and tooling Apache-2.0.
No account, no email address, no sales call.
PDF
White paper (PDF)The full framework: rationale, positioning, all eight domains, method, scoring, worked example and the complete sub-capability register.
Download · 1.1 MB
DOCX
White paper (Word)The same document in editable form, if you want to excerpt it into your own material.
Download · 91 KB
XLSX
Self-assessment workbook15 tabs: setup, eight domain tabs with full 0–5 descriptors as cell comments, all 697 ATT&CK techniques, dashboard with radar chart, ranked roadmap, crosswalk.
Download · 172 KB
XLSX
Worked example workbookA completed assessment, pre-filled, so you can see what the output looks like before you start.
Download · 176 KB
HTML
Offline assessment toolThe same tool as the online version, as a single file. Works with no network connection at all.
Download · 363 KB
CSV
ATT&CK datasetNormalised ATT&CK Enterprise v19.2: tactics, platforms, required data components, detection guidance and mitigations per technique.
Download · 428 KB
JSON
Machine-readable modelThe complete model — domains, sub-capabilities, every level descriptor, evidence criteria, profiles and crosswalks.
Download · 121 KB
CSV
Threat actor technique profiles1,057 ATT&CK groups, campaigns, malware and tools with the techniques each uses — the data behind the threat profiling step.
Download · 588 KB
CSV
ATT&CK detection strategiesEvery technique's v19 detection strategies and analytics with the concrete log sources they require.
Download · 167 KB
YAML
Telemetry catalogueHow to enable the log sources that carry the bulk of ATT&CK's analytics: channels, tool class and free routes.
Download · 16 KB
JSON
Example scored reportOutput of the scoring engine on the worked example, including the constraint log and ranked priorities.
Download · 29 KB
MITRE ATT&CK content in the dataset is © The MITRE Corporation and used under the ATT&CK Terms of Use.