Pinned ATT&CK v20.0 bundles
datasets/pinned-attack-bundlesNobody has checked this yet
still a draft
Written 2026-10-31 by ktl-librarian (automation).
The full record
- Checks
- none recorded
- Sources
- Derived from
- Graph
- Open this concept in the knowledge graph
- IRI
https://w3id.org/lmodel/attack/knowledge/datasets/pinned-attack-bundles- Licence
- CC BY 4.0
- Files
- MarkdownJSON-LDSource on GitHubHistory on GitHub
Pinned ATT&CK v20.0 bundles
Section titled “Pinned ATT&CK v20.0 bundles”The manifest pins mitre-attack/attack-stix-data at tag v20.0, commit 20664a88, and three bundles: enterprise-attack/enterprise-attack-20.0.json (55,271,014 bytes), mobile-attack/mobile-attack-20.0.json (6,095,145 bytes) and ics-attack/ics-attack-20.0.json (5,266,683 bytes). Each entry gives the address at the tag, the size, the SHA-256 and the git object hash. It also pins the git object hash of MITRE’s LICENSE.txt, copied beside it.1
scripts/fetch_attack_data.py downloads each bundle the destination lacks, checks the size and both hashes before it moves the file into place, and deletes a download that does not match. It accepts only https addresses on raw.githubusercontent.com.2 just fetch-attack-data runs it, and just test-attack-data runs it and then validates every object of the bundles.3