MITRE ATT&CK Enterprise (STIX 2.1)

mitre.attack.enterprise@17.1

Adversary tactics, techniques and mitigations as a threat knowledge graph.

publishedMITRE-TERMS Verified publisher 3,560 installs

Content is not redistributed by the Marketplace

This package provides mappings, metadata and integration scaffolding only. Obtain the underlying content directly from MITRE under its own licence.

Go to source

Overview

The Enterprise ATT&CK knowledge base in STIX 2.1, mapped to Threat, Technique and Mitigation concepts so a CDT can reason from observed telemetry to likely adversary behaviour.

What's inside

mappings

attack-to-cyber-core.ttl

instances

enterprise-attack.json

documentation

README.md
ATTRIBUTION.md

Artifact types

Ontology Mapping· Ontologies Instance Dataset· Instance Models Reference Dataset· Data

Dependencies

nimble.cyber.core>=1.0.0Cybersecurity Core Ontology

Used by

Water Infrastructure Cybersecurity Pack UAV Cybersecurity Pack

Version history

v17.1latestNimble ≥ 1.0.08/29/2026
Current release.
v0.9.0Nimble ≥ 1.0.01/31/2026
Initial public preview.

Manifest

Nimble consumes this machine-readable manifest when resolving and installing the package.

{
  "package": {
    "id": "mitre.attack.enterprise",
    "name": "MITRE ATT&CK Enterprise (STIX 2.1)",
    "version": "17.1",
    "status": "published"
  },
  "publisher": {
    "name": "MITRE",
    "type": "non-profit"
  },
  "domains": [
    "cybersecurity",
    "critical-infrastructure"
  ],
  "solution_areas": [
    "threat-management",
    "security-operations",
    "incident-response"
  ],
  "artifacts": [
    "ontology-mapping",
    "instance-dataset",
    "reference-dataset"
  ],
  "dependencies": [
    {
      "id": "nimble.cyber.core",
      "version": ">=1.0.0",
      "optional": false
    }
  ],
  "compatibility": {
    "nimble": {
      "minimum": "1.0.0",
      "maximum": null
    }
  },
  "license": {
    "type": "MITRE-TERMS",
    "name": "MITRE Terms of Use",
    "url": "https://www.mitre.org/legal-terms-of-use",
    "redistribution": "bundled",
    "attribution_required": true,
    "attribution": "MITRE ATT&CK, copyright The MITRE Corporation. Used under MITRE terms of use.",
    "source_authority": "MITRE",
    "source_url": "https://attack.mitre.org"
  },
  "validation": {
    "security": "scanned",
    "validation": "validated"
  },
  "contents": {
    "mappings": [
      "attack-to-cyber-core.ttl"
    ],
    "instances": [
      "enterprise-attack.json"
    ],
    "documentation": [
      "README.md",
      "ATTRIBUTION.md"
    ]
  },
  "distribution": {
    "available": false,
    "reason": "bundled"
  }
}