mitreattack-python
This repository contains a library of Python tools and utilities for working with ATT&CK data. For more information, see the full documentation on ReadTheDocs.
Install
To use this package, install the mitreattack-python library with pip:
pip install mitreattack-python
MitreAttackData Library
The MitreAttackData library is used to read in and work with MITRE ATT&CK STIX 2.0 content. This library provides
the ability to query the dataset for objects and their related objects. This is the main content of mitreattack-python;
you can read more about other modules in this library under "Additional Modules".
Related MITRE Work
CTI
Cyber Threat Intelligence repository of the ATT&CK catalog expressed in STIX 2.0 JSON. This repository also contains our USAGE document which includes additional examples of accessing and parsing our dataset in Python.
ATT&CK
ATT&CK® is a curated knowledge base and model for cyber adversary behavior, reflecting the various phases of an adversary’s lifecycle, and the platforms they are known to target. ATT&CK is useful for understanding security risk against known adversary behavior, for planning security improvements, and verifying defenses work as expected.
STIX
Structured Threat Information Expression (STIX™) is a language and serialization format used to exchange cyber threat intelligence (CTI).
STIX enables organizations to share CTI with one another in a consistent and machine-readable manner, allowing security communities to better understand what computer-based attacks they are most likely to see and to anticipate and/or respond to those attacks faster and more effectively.
STIX is designed to improve many capabilities, such as collaborative threat analysis, automated threat exchange, automated detection and response, and more.
https://oasis-open.github.io/cti-documentation/
Contributing
To contribute to this project, either through a bug report, feature request, or merge request, please see the Contributors Guide.
Release files for mitreattack-python 6.3.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| mitreattack_python-6.3.1.tar.gz | 558.0 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| mitreattack_python-6.3.1-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 1.1 MB
Release files / mitreattack_python-6.3.1.tar.gz
| Download URL | mitreattack_python-6.3.1.tar.gz |
|---|---|
| Size | 558.0 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
7951ef47ca19061d69095cd7754b34606d39ba716881bc069f7afdc10d5390a6
|
|
BLAKE2b-256 checksum How to use checksums |
df16048c37b85e9d0f750e139e48343f953221cc6129901431640f838860fcad
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 13, 2026.
Transparency logRelease files / mitreattack_python-6.3.1-py3-none-any.whl
| Download URL | mitreattack_python-6.3.1-py3-none-any.whl |
|---|---|
| Size | 575.4 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
043f0185afb3063b1f101ca1c2ba75f84f01f35a6af4ec31c255b8b173757489
|
|
BLAKE2b-256 checksum How to use checksums |
aab93f147c3d037e3c3eca83f7961b037e8839599d5cf69436a086f7f27fa7f6
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 13, 2026.
Transparency log
