Mitre Attack Python Packages

mitreattack-python

A python module for working with ATT&CK

shuffle-sdk

Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.

agentmetry

Local-first flight recorder for AI coding agents. Hash-chained audit trail, MITRE-mapped sequence detection, DLP. Forwards to the SIEM you already run.

mitrecve

Get all cve corresponding to a specific keyword or a list of keywords from the mitre database (https://cve.mitre.org/)

arango-cve-processor

A small python script that enriches Vulnerability STIX Objects with other intel

netforensicai

Local-first, open-source DFIR investigation platform. Correlates pcap, JSON/CSV and Windows EVTX/Sysmon evidence into one traceable timeline, entity graph and evidence-cited findings - with offline detection rules, MITRE ATT&CK mapping, a local web UI, live capture, and an optional AI assistant that cannot fabricate citations.

gokdogan-triage

Static PE malware triage engine — imphash/entropy/packer/strings/capabilities/YARA + MITRE ATT&CK, weighted verdict. No sample execution, offline core.

vamp-log-analyzer

Plataforma forense de análisis de logs multiplataforma — 25 detectores FORA, timeline, reconstrucción de sesiones, cadena de custodia, IOC export, mapeo MITRE ATT&CK — VampSecure Labs

sys-inspector

eBPF-based forensic and security inspection for Linux: live process tree, persistence enumeration and normalized findings mapped to MITRE ATT&CK, in self-contained encrypted reports. https://build.opensuse.org/project/show/home:mariosergiosl:sys-inspector

1200km-aidebug

Evidence-focused malware reverse engineering with deep PE/.NET inspection, Ghidra reconstruction, AI cross-checks, YARA, and ELF debugging

fibratus

Security sensor for realtime threat detection and protection

stride-gpt

An AI-powered threat modeling tool that leverages OpenAI's GPT models to generate threat models for a given application based on the STRIDE methodology.

pcaptriage

Automated pcap triage on top of Zeek: MITRE ATT&CK-mapped findings and an HTML report, in one command.

aisoc-sandbox

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

misp-maltego

Set of Maltego transforms to inferface with a MISP Threat Sharing instance, and also to explore the whole MITRE ATT&CK dataset.

openagentontology

The first Agent Ontology: map every AI agent action to the governance control that answers for it, across NIST 800-53, EU AI Act, OWASP LLM Top 10, and MITRE ATT&CK. Signed, reproducible, open-source.

arango-cti-processor

A small script that creates relationships between common CTI knowledge-bases in STIX 2.1 format.

sh-guard

Semantic shell command safety classifier — AST-based risk scoring for AI coding agents

zettelforge

Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and LangChain agents

malwagon

Scan a file for malware from your terminal. Automated malware analysis sandbox CLI with hypervisor-level agentless dynamic analysis, BYOVD kernel driver analysis and AI-assisted reporting. pip install malwagon

secopstm

OWASP Python framework for automated STRIDE threat modeling as code — MITRE ATT&CK mapping, D3FEND mitigations, Attack Flow, CAPEC, severity scoring, SVG/HTML reports & MITRE Navigator layers. DevSecOps & CI/CD ready.

redgap

Automated MITRE ATT&CK offense-detection coverage harness - deterministic, no AI in the verdict.

cepheus-engine

Container escape scenario modeler — enumerate container security posture and model realistic escape paths

vuln-prioritizer-workbench

Local-first workbench for explainable CVE prioritization from scanner, SBOM, VEX, and asset evidence.