---
name: mitre-attack-ingestion
description: "How to get MITRE ATT&CK® STIX Data data into a pandas DataFrame and Parquet: access, the request, the format, limits, quirks and terms."
---

# Load MITRE ATT&CK® Enterprise techniques into pandas and Parquet

Source entry: https://signal-lab-jet.vercel.app/datasets/mitre-attack
Provider: https://attack.mitre.org/resources/attack-data-and-tools/
Checked against the provider's documentation: 2026-11-03

## Access
- No account or key. STIX 2.1 bundles download from the mitre-attack/attack-stix-data GitHub repository; the same data is served by MITRE's read-only TAXII 2.1 server.
- enterprise-attack.json always matches the latest Enterprise release; versioned files such as enterprise-attack-19.2.json pin a release.

## Request
```bash
curl -L -O 'https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json'
```

## Format
STIX 2.1 bundle (JSON) with an objects array: attack-pattern (techniques and sub-techniques), x-mitre-tactic, intrusion-set (groups), malware and tool (software), campaign, course-of-action (mitigations), relationship and an x-mitre-collection object carrying the release version. Technique IDs such as T1059 sit in external_references under source_name mitre-attack.

## Load into pandas and Parquet
Needs Python 3 with requests, pandas and pyarrow.
```python
"""MITRE ATT&CK Enterprise (STIX 2.1) -> pandas -> Parquet. No key."""
import requests
import pandas as pd

URL = "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json"
r = requests.get(URL, timeout=180)
r.raise_for_status()
objects = r.json()["objects"]
rows = []
for o in objects:
    if o.get("type") != "attack-pattern" or o.get("revoked") or o.get("x_mitre_deprecated"):
        continue
    ref = next(x for x in o["external_references"] if x.get("source_name") == "mitre-attack")
    rows.append({
        "technique_id": ref["external_id"],
        "name": o["name"],
        "tactics": ";".join(p["phase_name"] for p in o.get("kill_chain_phases", [])),
        "platforms": ";".join(o.get("x_mitre_platforms", [])),
        "is_subtechnique": bool(o.get("x_mitre_is_subtechnique")),
        "modified": o["modified"],
        "url": ref.get("url"),
    })
df = pd.DataFrame(rows).sort_values("technique_id")
df.to_parquet("attack_enterprise_techniques.parquet", index=False)
version = next(o["x_mitre_version"] for o in objects if o.get("type") == "x-mitre-collection")
print(len(df), "Enterprise techniques and sub-techniques; collection version", version,
      "; sub-techniques:", int(df["is_subtechnique"].sum()))
```
Run by us on 2026-11-03 (python 3.13.5 | pandas 3.1.0 | pyarrow 26.0.0 | requests 2.34.2). Result: 706 Enterprise techniques and sub-techniques; collection version 20.0 ; sub-techniques: 479

## Limits
- Rate limits: Not stated.
- The Enterprise bundle is large (about 55 MB on 2026-11-03), so download it once per release rather than per lookup.

## Quirks
- The STIX data keeps revoked and deprecated objects; filter on revoked and x_mitre_deprecated before counting or mapping.
- Tactics come from kill_chain_phases phase_name values (for example execution), not from a field on the technique.
- Group-to-technique and software-to-technique links are separate relationship objects; join on source_ref and target_ref.

## Terms and attribution
- MITRE grants a non-exclusive, royalty-free licence for research, development and commercial use.
- Any copy must reproduce MITRE's copyright designation and the licence; the ATT&CK name must not imply MITRE's endorsement.
- Terms page: https://attack.mitre.org/resources/legal-and-branding/terms-of-use/

## Sources
- https://attack.mitre.org/resources/legal-and-branding/terms-of-use/: "The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes."
- https://attack.mitre.org/resources/attack-data-and-tools/: "The ATT&CK dataset is available in STIX 2.0 and STIX 2.1."
- https://attack.mitre.org/resources/attack-data-and-tools/: "The ATT&CK TAXII server provides API access to the ATT&CK STIX knowledge base."
- https://attack.mitre.org/resources/faq/: "How often is ATT&CK updated? Bi-annually."
- https://github.com/mitre-attack/attack-stix-data: "Each domain includes a STIX 2.1 collection bundle without version markings which will always match the most recent release of the dataset."

## Help improve this skill
Missing a source, or see something to improve? Call the MCP tool suggest_source or feedback (or POST /api/suggest or /api/feedback). Reviewed ideas: https://signal-lab-jet.vercel.app/agent-suggestions

Information for educational purposes only. Free tiers, limits and licenses belong to the providers and may change; check the provider's own terms before using the data.