threat-informed-defense 开源项目推荐（27 个）

center-for-threat-informed-defense /adversary_emulation_library

一个开放的对手模拟计划库，旨在使组织能够基于现实世界的TTP测试其防御。

center-for-threat-informed-defense /attack-flow

Attack Flow helps executives, SOC managers, and defenders easily understand how attackers compose ATT&CK techniques into attacks by developing a representation of attack flows, modeling attack flows for a small corpus of incidents, and creating visualization tools to display attack flows.

center-for-threat-informed-defense /tram

TRAM is an open-source platform designed to advance research into automating the mapping of cyber threat intelligence reports to MITRE ATT&CK®.

center-for-threat-informed-defense /attack-control-framework-mappings

🚨ATTENTION🚨 The NIST 800-53 mappings have migrated to the Center’s Mappings Explorer project. See README below. This repository is kept here as an archive.

center-for-threat-informed-defense /cti-blueprints

CTI Blueprints is a free suite of templates and tools that helps Cyber Threat Intelligence analysts create high-quality, actionable reports more consistently and efficiently.

center-for-threat-informed-defense /attack_to_cve

🚨ATTENTION🚨 The CVE mappings have migrated to the Center’s Mappings Explorer project. See README below. This repository is kept here as an archive.

center-for-threat-informed-defense /insider-threat-ttp-kb

The principal objective of this project is to develop a knowledge base of the tactics, techniques, and procedures (TTPs) used by insiders in the IT environment. It will establish an Insider Threat TTP Knowledge Base, built upon data collected on insider threat incidents and lessons learned and experience from the ATT&CK knowledge base.

center-for-threat-informed-defense /caldera_pathfinder

Pathfinder is a plugin for mapping network vulnerabilities, scanned by CALDERA or imported by a supported network scanner, and translating those scans into adversaries for network traversal.

center-for-threat-informed-defense /attack_to_veris

🚨ATTENTION🚨 The VERIS mappings have migrated to the Center’s Mappings Explorer project. See README below. This repository is kept here as an archive.

center-for-threat-informed-defense /summiting-the-pyramid

Summiting the Pyramid is a research project focused on engineering cyber analytics to make adversary evasion more difficult. The research includes a scoring model, methodology, and worked examples.

center-for-threat-informed-defense /sensor-mappings-to-attack

Sensor Mappings to ATT&CK is a collection of resources to assist cyber defenders with understanding which sensors and events can help detect real-world adversary behaviors in their environments.

center-for-threat-informed-defense /attack-sync

ATT&CK Sync is a Center for Threat-Informed Defense project that aims to improve the ability for organizations to consume MITRE ATT&CK® version updates into their internal systems and processes.

center-for-threat-informed-defense /m3tid

The Measure, Maximize, and Mature Threat-Informed Defense (M3TID) project defines what Threat-Informed Defense (TID) is and the key activities associated with its practice.

center-for-threat-informed-defense /threat-modeling-with-attack

Threat Modeling with ATT&CK defines how to integreate MITRE ATT&CK® into your organization’s existing threat modeling methodology.

center-for-threat-informed-defense /defending-iaas-with-attack

Defending IaaS with ATT&CK is a project to create a collection of ATT&CK techniques relevant to a Linux IaaS environment, as well as a methodology for creating technique collections.

center-for-threat-informed-defense /cwe-calculator

The CWE Calculator enables software development teams to score and prioritize discovered weaknesses empirically based on data in the National Vulnerability Database (NVD).

TeamStarWolf /TeamStarWolf

An open cybersecurity reference library for the community: references, how-to guides, and learning paths for defenders, learners, and anyone with a security job to do, plus published data cross-referenced to ATT&CK, D3FEND, ATLAS, and NIST SP 800-53. Original content is MIT-licensed.

ayuksel-tenb /tenable-attack-mapper

MCP server that maps Tenable Security Center findings to the MITRE ATT&CK framework, then lets you ask your LLM (Claude Code) to analyze exposure by specific tactic or technique in plain language — and optionally open the results as an interactive ATT&CK Navigator matrix in a local web viewer.

ReZaAdineH /Unified-Threat-Informed-Operations-Model-Framework-UTIOM

UTIOM — Unified Threat-Informed Operations Model. A lifecycle framework connecting leadership intent, detection engineering and incident response into one measurable system. Seven phases, three pillars, four browser-based assessment tools. Free, open, no signup, nothing leaves your browser.

ReZaAdineH /tir-cmm

Threat Informed Response Capability Maturity Model