Skip to content
attack

Where the data departs from the ATT&CK Data Model

Explanationexplanations/data-departures

Nobody has checked this yet

still a draft

Written 2026-10-31 by ktl-librarian (automation).

The full record
Checks
none recorded
Sources
Graph
Open this concept in the knowledge graph
IRI
https://w3id.org/lmodel/attack/knowledge/explanations/data-departures
Licence
CC BY 4.0
Files
MarkdownJSON-LDSource on GitHubHistory on GitHub

Where the data departs from the ATT&CK Data Model

Section titled “Where the data departs from the ATT&CK Data Model”

The schema follows the data MITRE publishes. Where the v20.0 data breaks a rule of the ADM, the schema accepts the data, and tests/test_upstream.py lists the departure with its reason and the number of objects it covers:1

  • Enterprise’s tactics TA0005 and TA0112 have the short names stealth and defense-impairment, which the ADM’s list lacks (2 tactics).
  • Three revoked Enterprise techniques keep the platform Office 365, which the ADM’s list lacks (3).
  • Fourteen revoked Mobile techniques have no kill chain phase, which the ADM asks of every technique (14).
  • Those fourteen name mitre-mobile-attack, and twelve deprecated ICS techniques mitre-ics-attack, as the source of their ATT&CK ID, where the ADM asks for mitre-attack (26).
  • Deprecated Enterprise mitigations carry the ID of the technique they were written for (224).
  • A malware is revoked by a tool, where the ADM asks for an object of the same type (1).

The extract holds an object of each, and just test-attack-data holds each departure to its count, so a release that changes one fails until the list follows it. docs/about.md names them for a reader of the schema.2

Across a bundle, the data also breaks three statements of the ADM’s documentation. tests/test_upstream.py lists each breach by ATT&CK ID, in four groups with their reasons:3

  • 16 retired Enterprise sub-techniques have no parent, where the ADM says each sub-technique has one.
  • 9 current sub-techniques, six in Enterprise and three in ICS, name a platform their parent lacks.
  • 7 log source references name a log and channel their data component does not list, such as linus:syslog.
  • 12 ICS log source references name one of four Enterprise data components, which the ICS bundle does not hold.

just test-attack-data fails both on a new breach and on a listed one that no longer occurs.3

Footnotes

Section titled “Footnotes”

  1. tests/test_upstream.py, KNOWN_DEPARTURES ↩

  2. docs/about.md, Where the data departs from the ADM ↩

  3. tests/test_upstream.py, KNOWN_BUNDLE_DEPARTURES ↩ ↩2