MITRE ATT&CK® STIX Data

Use in your agent

Load MITRE ATT&CK® Enterprise techniques into pandas and Parquet. Checked against the provider's documentation on Nov 3, 2026.

Access

• No account or key. STIX 2.1 bundles download from the mitre-attack/attack-stix-data GitHub repository; the same data is served by MITRE's read-only TAXII 2.1 server.
• enterprise-attack.json always matches the latest Enterprise release; versioned files such as enterprise-attack-19.2.json pin a release.

Request

curl -L -O 'https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json'

Format

STIX 2.1 bundle (JSON) with an objects array: attack-pattern (techniques and sub-techniques), x-mitre-tactic, intrusion-set (groups), malware and tool (software), campaign, course-of-action (mitigations), relationship and an x-mitre-collection object carrying the release version. Technique IDs such as T1059 sit in external_references under source_name mitre-attack.

Load into pandas and Parquet

Needs Python 3 with requests, pandas and pyarrow.

"""MITRE ATT&CK Enterprise (STIX 2.1) -> pandas -> Parquet. No key."""
import requests
import pandas as pd

URL = "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json"
r = requests.get(URL, timeout=180)
r.raise_for_status()
objects = r.json()["objects"]
rows = []
for o in objects:
    if o.get("type") != "attack-pattern" or o.get("revoked") or o.get("x_mitre_deprecated"):
        continue
    ref = next(x for x in o["external_references"] if x.get("source_name") == "mitre-attack")
    rows.append({
        "technique_id": ref["external_id"],
        "name": o["name"],
        "tactics": ";".join(p["phase_name"] for p in o.get("kill_chain_phases", [])),
        "platforms": ";".join(o.get("x_mitre_platforms", [])),
        "is_subtechnique": bool(o.get("x_mitre_is_subtechnique")),
        "modified": o["modified"],
        "url": ref.get("url"),
    })
df = pd.DataFrame(rows).sort_values("technique_id")
df.to_parquet("attack_enterprise_techniques.parquet", index=False)
version = next(o["x_mitre_version"] for o in objects if o.get("type") == "x-mitre-collection")
print(len(df), "Enterprise techniques and sub-techniques; collection version", version,
      "; sub-techniques:", int(df["is_subtechnique"].sum()))

Run by us on 2026-11-03 (python 3.13.5 | pandas 3.1.0 | pyarrow 26.0.0 | requests 2.34.2). Result: 706 Enterprise techniques and sub-techniques; collection version 20.0 ; sub-techniques: 479

Limits

• Rate limits: Not stated.
• The Enterprise bundle is large (about 55 MB on 2026-11-03), so download it once per release rather than per lookup.

Quirks

• The STIX data keeps revoked and deprecated objects; filter on revoked and x_mitre_deprecated before counting or mapping.
• Tactics come from kill_chain_phases phase_name values (for example execution), not from a field on the technique.
• Group-to-technique and software-to-technique links are separate relationship objects; join on source_ref and target_ref.

Terms and attribution

• MITRE grants a non-exclusive, royalty-free licence for research, development and commercial use.
• Any copy must reproduce MITRE's copyright designation and the licence; the ATT&CK name must not imply MITRE's endorsement.

Sources

• https://attack.mitre.org/resources/legal-and-branding/terms-of-use/: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes.”
• https://attack.mitre.org/resources/attack-data-and-tools/: “The ATT&CK dataset is available in STIX 2.0 and STIX 2.1.”
• https://attack.mitre.org/resources/attack-data-and-tools/: “The ATT&CK TAXII server provides API access to the ATT&CK STIX knowledge base.”
• https://attack.mitre.org/resources/faq/: “How often is ATT&CK updated? Bi-annually.”
• https://github.com/mitre-attack/attack-stix-data: “Each domain includes a STIX 2.1 collection bundle without version markings which will always match the most recent release of the dataset.”