APT战术映射与防御评估
原名：analyzing-threat-actor-ttps-with-mitre-navigator
使用 attackcti 库查询 STIX/TAXII 数据，将 APT 组织 TTPs 映射至 MITRE ATT&CK 框架，生成 Navigator 图层文件以可视化防御覆盖并对比威胁画像。
- 分类
- 数据分析
- 版本
- v1.0
- 作者
- 弈韬(@ra1nzzz)
- 下载
- 0
- 收藏
- 0
- 发布
- 2026-08-18
- 更新
- 2026-08-19
- TRACE 评分
- 3.4 / 5
内容概览
The MITRE ATT&CK Navigator is a web application for annotating and visualizing ATT&CK matrices. Combined with the attackcti Python library (which queries ATT&CK STIX data via TAXII), analysts can programmatically generate Navigator layer files mapping specific threat group TTPs, compare multiple groups, and assess detection coverage gaps against known adversaries. - When investigating security incidents that require analyzing threat actor ttps with mitre navigator - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques - Python 3.8+ with attackcti and stix2 libraries installed - MITRE ATT&CK Navigator (web UI or local instance) - Understanding of STIX 2.1 objects and relationships 1. Query ATT&CK STIX data for target threat g…