Skip to content
@center-for-threat-informed-defense

The Center for Threat-Informed Defense

An R&D organization focused on advancing the state of the art and the state of the practice in threat-informed defense.
README.md

Changing the Game on the Adversary

The Center is a non-profit, privately funded research and development organization operated by MITRE Engenuity. The Center’s mission is to advance the state of the art and the state of the practice in threat-informed defense globally.

Comprised of participant organizations from around the globe with highly sophisticated security teams, the Center builds on MITRE ATT&CK®, an important foundation for threat-informed defense used by security teams and vendors in their enterprise security operations.

THE RESULTS OF OUR RESEARCH & DEVELOPMENT PROJECTS ARE FREELY AVAILABLE TO THE PUBLIC.

Pinned Loading

  1. mappings-explorer mappings-explorer Public

    Mappings Explorer enables cyber defenders to understand how security controls and capabilities map onto the adversary behaviors catalogued in the MITRE ATT&CK® knowledge base. These mappings form a…

    Jinja 101 17

  2. adversary_emulation_library adversary_emulation_library Public

    An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs.

    C 2.1k 368

  3. attack-flow attack-flow Public

    Attack Flow helps executives, SOC managers, and defenders easily understand how attackers compose ATT&CK techniques into attacks by developing a representation of attack flows, modeling attack flow…

    TypeScript 757 125

  4. summiting-the-pyramid summiting-the-pyramid Public

    Summiting the Pyramid is a research project focused on engineering cyber analytics to make adversary evasion more difficult. The research includes a scoring model, methodology, and worked examples.

    Makefile 61 7

  5. tram tram Public

    TRAM is an open-source platform designed to advance research into automating the mapping of cyber threat intelligence reports to MITRE ATT&CK®.

    Jupyter Notebook 573 114

Repositories

Showing 10 of 31 repositories
  • mappings-explorer Public

    Mappings Explorer enables cyber defenders to understand how security controls and capabilities map onto the adversary behaviors catalogued in the MITRE ATT&CK® knowledge base. These mappings form a bridge between the threat-informed approach to cybersecurity and the traditional security controls perspective.

    center-for-threat-informed-defense/mappings-explorer's past year of commit activity
    Jinja 101 Apache-2.0 17 0 6 Updated Jul 8, 2026
  • insider-threat-ttp-kb Public

    The principal objective of this project is to develop a knowledge base of the tactics, techniques, and procedures (TTPs) used by insiders in the IT environment. It will establish an Insider Threat TTP Knowledge Base, built upon data collected on insider threat incidents and lessons learned and experience from the ATT&CK knowledge base.

    center-for-threat-informed-defense/insider-threat-ttp-kb's past year of commit activity
    Python 156 Apache-2.0 19 0 0 Updated Jul 6, 2026
  • fight-fraud-framework Public
    center-for-threat-informed-defense/fight-fraud-framework's past year of commit activity
    Vue 22 Apache-2.0 2 4 2 Updated Jun 23, 2026
  • attack-flow Public

    Attack Flow helps executives, SOC managers, and defenders easily understand how attackers compose ATT&CK techniques into attacks by developing a representation of attack flows, modeling attack flows for a small corpus of incidents, and creating visualization tools to display attack flows.

    center-for-threat-informed-defense/attack-flow's past year of commit activity
    TypeScript 757 Apache-2.0 125 21 7 Updated Jun 18, 2026
  • attack-sync Public

    ATT&CK Sync is a Center for Threat-Informed Defense project that aims to improve the ability for organizations to consume MITRE ATT&CK® version updates into their internal systems and processes.

    center-for-threat-informed-defense/attack-sync's past year of commit activity
    Python 28 Apache-2.0 9 2 0 Updated May 19, 2026
  • technique-inference-engine Public

    TIE is a machine learning model for inferring associated MITRE ATT&CK techniques from previously observed techniques.

    center-for-threat-informed-defense/technique-inference-engine's past year of commit activity
    Jupyter Notebook 73 Apache-2.0 15 0 1 Updated May 19, 2026
  • mappings-editor Public

    Mappings Editor is an interactive, web-based tool created by the Center for Threat-Informed Defense for creating mappings of security capabilities to MITRE ATT&CK®. This tool is available as a public beta.

    center-for-threat-informed-defense/mappings-editor's past year of commit activity
    TypeScript 16 Apache-2.0 3 1 1 Updated May 15, 2026
  • attack-powered-suit Public

    ATT&CK Powered Suit is a browser extension that puts the complete MITRE ATT&CK® knowledge base at your fingertips with text search, context menus, and ATT&CK Navigator integration.

    center-for-threat-informed-defense/attack-powered-suit's past year of commit activity
    JavaScript 83 Apache-2.0 15 6 0 Updated Apr 29, 2026
  • summiting-the-pyramid Public

    Summiting the Pyramid is a research project focused on engineering cyber analytics to make adversary evasion more difficult. The research includes a scoring model, methodology, and worked examples.

    center-for-threat-informed-defense/summiting-the-pyramid's past year of commit activity
    Makefile 61 Apache-2.0 7 2 2 Updated Mar 2, 2026
  • inform Public
    center-for-threat-informed-defense/inform's past year of commit activity
    Makefile 0 Apache-2.0 0 0 0 Updated Jan 8, 2026
View all repositories

Top languages

Loading…

Most used topics

Loading…