Skip to content
attack

Datasets

  • attack LinkML schema nobody has checked this yet, still a draft
    The LinkML schema of MITRE ATT&CK v20.0 in STIX 2.1, src/attack/schema/attack.yaml (schema id https://w3id.org/lmodel/attack): 24 classes with the Attack prefix, each object class extending a lmodel/stix class, 12 enums and 37 slots, most of them ATT&CK’s x_mitre_* keys. Its lokf adapt copy .lokf/attack.yaml, rooted on StixObject and StixBundle, is the bundle’s domain schema.

  • Generated artefacts nobody has checked this yet, still a draft
    What just gen-project and just gen-doc write from the schema: the formats under project/, the Python dataclasses and Pydantic models under src/attack/datamodel/, docs/schema/attack.yaml and the schema pages under docs/elements/; never edited by hand.

  • lmodel/stix modules nobody has checked this yet, still a draft
    The six modules of lmodel/stix’s STIX 2.1 schema that the ATT&CK schema imports, copied unchanged into src/attack/schema/stix/ from stix v0.1.0 and held to their git object hashes by tests/test_stix_import.py.

  • Pinned ATT&CK v20.0 bundles nobody has checked this yet, still a draft
    The three STIX bundles of ATT&CK v20.0 (Enterprise, Mobile and ICS), kept out of git and pinned by address, size, SHA-256 and git object hash in tests/data/attack-stix-data/manifest.json; just fetch-attack-data downloads them into tmp/attack-stix-data/.

  • Test data and tests nobody has checked this yet, still a draft
    The tests and their data under tests/: 21 valid examples and 72 counter-examples, an extract of 97 objects of the v20.0 bundles, the checks of the ATT&CK Data Model’s rules beyond the validator, the lists of where the data departs from it, and the neighbours’ adapt copies.