A powerful security analysis tool that maps free-text threat descriptions and incident report files to specific MITRE ATT&CK techniques and tactics.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install toolweb-mitre-attack-mapper
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install toolweb-mitre-attack-mapper using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is MITRE ATT&CK Technique Mapper?
The MITRE ATT&CK Technique Mapper is a specialized security intelligence tool designed to bridge the gap between raw incident data and actionable defensive frameworks. By leveraging Openclaw Skills, developers and security analysts can automate the identification of attacker behaviors, transforming vague threat narratives into structured data including technique IDs, confidence scores, and kill chain positions.
This skill is an essential asset for Security Operations Centers (SOC) and threat hunters, providing not only technique identification but also vital context such as detection guidance and M-series mitigation recommendations. Whether you are processing a single SIEM alert or a complex multi-page PDF incident report, this tool streamlines the mapping process to ensure consistent alignment with the global MITRE ATT&CK knowledge base.
MITRE ATT&CK Technique Mapper Use Cases
- Automating the mapping of SIEM or EDR alert text to specific MITRE tactics.
- Extracting structured TTPs from PDF or DOCX threat intelligence bulletins.
- Enhancing penetration testing reports with validated ATT&CK technique IDs.
- Correlating incident narratives with known threat actor groups (e.g., APT29, Lazarus).
- Generating ATT&CK Navigator layers for visual coverage assessment during incident response.
How MITRE ATT&CK Technique Mapper Works
- The user provides input via plain text, a file upload (PDF, TXT, DOCX, CSV), or both.
- The Openclaw Skills engine processes the input using natural language processing to identify behavioral patterns.
- The skill queries the MITRE ATT&CK database to find the highest-confidence matches for techniques and tactics.
- A comprehensive JSON response is generated, containing identified techniques, detection logic, and mitigation strategies.
- The output includes threat actor associations and kill chain coverage to provide full contextual awareness.
MITRE ATT&CK Technique Mapper Setup
To use this skill, you need a valid API key from ToolWeb. Submit requests using multipart/form-data to the map-technique endpoint.
MITRE ATT&CK Technique Mapper Data Schema & Taxonomy
The skill organizes security data into a structured taxonomy that aligns with global cybersecurity standards.
| Attribute | Description |
|---|---|
| techniques_identified | Total count of unique MITRE techniques found in the input. |
| mapped_techniques | Array containing technique IDs, names, tactic mapping, and confidence levels. |
| detection | Specific log sources and SIEM queries (e.g., Sysmon, Event IDs) to hunt for the behavior. |
| mitigations | List of ATT&CK M-series mitigations (e.g., M1049) to prevent the technique. |
| threat_actor_associations | Known groups (e.g., APT29, FIN7) associated with the identified TTPs. |
MITRE ATT&CK Technique Mapper Advanced Features
- Multi-format support including PDF, DOCX, TXT, and CSV file parsing for bulk report analysis.
- Automated kill chain coverage visualization to see exactly where your defenses are being tested.
- High-fidelity threat actor mapping based on unique combinations of identified techniques.
- Direct integration with ATT&CK Navigator for easy layer exports and security posture visualization.
SKILL.md
Loading
Related Openclaw Skills
Image Scanner
An automated AI utility for scanning, analyzing, and classifying photography collections based on visual attributes and metadata.
Risk Sentiment Scanner
An automated corporate sentiment and credit risk analysis tool that transforms public news and regulatory data into structured risk reports using LLMs.
HTTP Client Reference
A local, zero-dependency reference tool providing instant access to HTTP Client best practices, patterns, and debugging guides.
Shell AI Reference
A zero-dependency reference tool providing instant access to Shell AI concepts, implementation patterns, and best practices.
Full Stack Dev Skill
A comprehensive expert-level development skill for building high-performance, full-stack applications using the Next.js 14 App Router, Supabase, and TypeScript.
LLM Chain for Langchain4J
A local-first AI toolkit for logging, benchmarking, and optimizing Large Language Model workflows and experiments.
Featured*
