# MITRE ATT\&CK Knowledge Base Scraper (`compute-edge/mitre-attack-scraper`) Actor Extract MITRE ATT\&CK techniques, tactics, groups, software, mitigations, and data sources from the Enterprise, Mobile, or ICS matrices. Filter by tactic phase or platform. - **URL**: https://apify.com/compute-edge/mitre-attack-scraper.md - **Developed by:** [Compute Edge](https://apify.com/compute-edge) (community) - **Categories:** Lead generation - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, NaN bookmarks - **User rating**: No ratings yet ## Pricing from $3.00 / 1,000 results This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## MITRE ATT&CK Knowledge Base Scraper Extract the **MITRE ATT&CK** knowledge base — the global, freely available adversary tactics, techniques, and procedures (TTPs) catalog used by every SOC, threat hunting team, and detection engineer on the planet. This Actor pulls structured records for techniques, tactics, threat groups, software (malware/tools), mitigations, data sources, and campaigns from the official MITRE STIX 2.1 bundles. ATT&CK powers detection-as-code, purple-team exercises, threat modeling, and red-team planning. Use this Actor to build always-fresh datasets for SIEM correlation rules, EDR detection coverage gap analysis, GRC mappings (NIST 800-53, ISO 27001), and AI threat-intel assistants. ### Key Features - **All three matrices** — Enterprise, Mobile, and ICS ATT&CK in one Actor - **Filter by object type** — Techniques, Tactics, Groups, Software, Mitigations, Data Sources, Campaigns - **Tactic filter** — Pull only techniques mapped to a kill-chain phase (e.g., `initial-access`, `lateral-movement`) - **Platform filter** — Filter techniques by target platform (Windows, Linux, macOS, Cloud, Containers, etc.) - **Skip deprecated/revoked** — Default to only current, active ATT&CK objects - **Direct ATT&CK URLs** — Every record includes the canonical `attack.mitre.org` URL - **No authentication** — Public MITRE CTI repository, no keys required ### Output Data Fields | Field | Description | |-------|-------------| | `attackId` | ATT&CK ID (e.g., T1059, S0002, G0007) | | `stixId` | Underlying STIX 2.1 object ID | | `type` | STIX object type (`attack-pattern`, `intrusion-set`, etc.) | | `name` | Object name | | `description` | Full description text | | `tactics` | Tactic phases the technique belongs to | | `platforms` | Targeted platforms (Windows, Linux, etc.) | | `dataSources` | Recommended data sources for detection | | `detection` | Detection guidance | | `permissionsRequired` | Privilege levels required | | `isSubtechnique` | True for sub-techniques (e.g., T1059.001) | | `version` | MITRE-assigned version | | `created` | Creation timestamp | | `modified` | Last modified timestamp | | `aliases` | Known aliases (for groups / software) | | `url` | Canonical attack.mitre.org URL | | `domain` | Source domain (`enterprise`, `mobile`, `ics`) | ### How to Scrape MITRE ATT&CK Data 1. Open the **MITRE ATT&CK Scraper** on Apify Store 2. Select the **ATT&CK Domain** (Enterprise by default) 3. Choose the **Object Type** (techniques, groups, software, etc.) 4. (Optional) Add a tactic filter (e.g., `credential-access`) or platform filter (e.g., `Windows`) 5. Click **Start** — clean structured JSON is written to the default dataset ### Pricing This Actor uses pay-per-result pricing. The MITRE bundles are static JSON files, so each run completes in seconds. A full Enterprise techniques extract (~700 records) is finished before the input form even closes. ### Use Cases - **Detection coverage analysis** — Map your EDR/SIEM rules to ATT&CK and find gaps - **Threat modeling** — Generate TTP shortlists per adversary group - **AI security assistants** — Feed ATT&CK into a RAG pipeline for incident triage chatbots - **Compliance mapping** — Cross-reference ATT&CK with NIST 800-53, ISO 27001 controls - **Purple team planning** — Pull techniques by tactic phase to design exercises ### Legal & Disclaimer This Actor reads public MITRE ATT&CK STIX bundles published by The MITRE Corporation under the [ATT&CK Terms of Use](https://attack.mitre.org/resources/terms-of-use/). MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. Users are responsible for compliance with MITRE's terms of use. This tool is provided "as is" without warranty of any kind. # Actor input Schema ## `domain` (type: `string`): Which ATT&CK matrix to extract from. ## `objectType` (type: `string`): Type of ATT&CK object to extract. ## `tacticFilter` (type: `string`): Filter techniques by tactic phase name (e.g., 'initial-access', 'lateral-movement', 'persistence'). ## `platformFilter` (type: `string`): Filter by platform (e.g., 'Windows', 'Linux', 'macOS', 'Cloud', 'Office 365'). ## `includeDeprecated` (type: `boolean`): Include deprecated or revoked ATT&CK objects. ## `maxResults` (type: `integer`): Maximum records to return (0 = unlimited). ## Actor input object example ```json { "domain": "enterprise", "objectType": "technique", "tacticFilter": "", "platformFilter": "", "includeDeprecated": false, "maxResults": 0 } ```` # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = {}; // Run the Actor and wait for it to finish const run = await client.actor("compute-edge/mitre-attack-scraper").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = {} # Run the Actor and wait for it to finish run = client.actor("compute-edge/mitre-attack-scraper").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{}' | apify call compute-edge/mitre-attack-scraper --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=compute-edge/mitre-attack-scraper", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "MITRE ATT&CK Knowledge Base Scraper", "description": "Extract MITRE ATT&CK techniques, tactics, groups, software, mitigations, and data sources from the Enterprise, Mobile, or ICS matrices. Filter by tactic phase or platform.", "version": "0.1", "x-build-id": "vdZ5iR1GshdwL6lGO" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/compute-edge~mitre-attack-scraper/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-compute-edge-mitre-attack-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/compute-edge~mitre-attack-scraper/runs": { "post": { "operationId": "runs-sync-compute-edge-mitre-attack-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/compute-edge~mitre-attack-scraper/run-sync": { "post": { "operationId": "run-sync-compute-edge-mitre-attack-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "domain": { "title": "ATT&CK Domain", "enum": [ "enterprise", "mobile", "ics" ], "type": "string", "description": "Which ATT&CK matrix to extract from.", "default": "enterprise" }, "objectType": { "title": "Object Type", "enum": [ "technique", "tactic", "group", "software", "mitigation", "data-source", "campaign" ], "type": "string", "description": "Type of ATT&CK object to extract.", "default": "technique" }, "tacticFilter": { "title": "Tactic Filter", "type": "string", "description": "Filter techniques by tactic phase name (e.g., 'initial-access', 'lateral-movement', 'persistence').", "default": "" }, "platformFilter": { "title": "Platform Filter", "type": "string", "description": "Filter by platform (e.g., 'Windows', 'Linux', 'macOS', 'Cloud', 'Office 365').", "default": "" }, "includeDeprecated": { "title": "Include Deprecated/Revoked", "type": "boolean", "description": "Include deprecated or revoked ATT&CK objects.", "default": false }, "maxResults": { "title": "Max Results", "minimum": 0, "maximum": 10000, "type": "integer", "description": "Maximum records to return (0 = unlimited).", "default": 0 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```