{"datasets/attack-linkml-schema":{"title":"attack LinkML schema","type":"Dataset","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The LinkML schema of MITRE ATT&CK v20.0 in STIX 2.1, `src/attack/schema/attack.yaml` (schema id `https://w3id.org/lmodel/attack`): 24 classes with the Attack prefix, each object class extending a lmodel/stix class, 12 enums and 37 slots, most of them ATT&CK's `x_mitre_*` keys. Its `lokf adapt` copy `.lokf/attack.yaml`, rooted on StixObject and StixBundle, is the bundle's domain schema."},"datasets/generated-artefacts":{"title":"Generated artefacts","type":"Dataset","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"What `just gen-project` and `just gen-doc` write from the schema: the formats under `project/`, the Python dataclasses and Pydantic models under `src/attack/datamodel/`, `docs/schema/attack.yaml` and the schema pages under `docs/elements/`; never edited by hand."},"datasets/pinned-attack-bundles":{"title":"Pinned ATT&CK v20.0 bundles","type":"Dataset","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The three STIX bundles of ATT&CK v20.0 (Enterprise, Mobile and ICS), kept out of git and pinned by address, size, SHA-256 and git object hash in `tests/data/attack-stix-data/manifest.json`; `just fetch-attack-data` downloads them into `tmp/attack-stix-data/`."},"datasets/stix-modules":{"title":"lmodel/stix modules","type":"Dataset","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The six modules of lmodel/stix's STIX 2.1 schema that the ATT&CK schema imports, copied unchanged into `src/attack/schema/stix/` from stix v0.1.0 and held to their git object hashes by `tests/test_stix_import.py`."},"datasets/test-data":{"title":"Test data and tests","type":"Dataset","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The tests and their data under `tests/`: 21 valid examples and 72 counter-examples, an extract of 97 objects of the v20.0 bundles, the checks of the ATT&CK Data Model's rules beyond the validator, the lists of where the data departs from it, and the neighbours' adapt copies."},"explanations/data-departures":{"title":"Where the data departs from the ATT&CK Data Model","type":"Explanation","genre":"explanation","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The six places where MITRE's v20.0 data departs from the ATT&CK Data Model v4.11.7, which the schema follows the data on: two tactic short names, a platform, revoked techniques without kill chain phases, retired techniques with their domain's source name, deprecated mitigations with a technique's ID, and a malware revoked by a tool. Also the 44 places where the data breaks a statement of the ADM's documentation across a bundle: sub-techniques without a parent or on a platform their parent lacks, and log source references to a log or data component that is not there."},"explanations/element-names":{"title":"Element names and the shared namespace","type":"Explanation","genre":"explanation","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"Why classes and enums carry the Attack prefix while slots keep the keys MITRE's data writes, which keys the adapt copy shares with lmodel/stix's copy and the released neighbours' copies, and why no class is shared."},"explanations/scope-and-influences":{"title":"Scope, influences and mappings","type":"Explanation","genre":"explanation","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"What the schema models (ATT&CK v20.0's objects across the Enterprise, Mobile and ICS domains), what it leaves out, what shaped it (ATT&CK and its data model alone) and why it maps nothing itself."},"glossary/analytic":{"title":"Analytic","type":"Glossary term","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"Detection logic for one platform."},"glossary/asset":{"title":"Asset","type":"Glossary term","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"A device or system in an industrial control system that techniques target."},"glossary/attack-domain":{"title":"ATT&CK domain","type":"Glossary term","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"One of ATT&CK's three technology domains: Enterprise, Mobile or ICS."},"glossary/attack-id":{"title":"ATT&CK ID","type":"Glossary term","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The human-readable identifier ATT&CK gives an object, such as T1059."},"glossary/campaign":{"title":"Campaign","type":"Glossary term","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"Intrusion activity over a stated period against common targets."},"glossary/data-component":{"title":"Data component","type":"Glossary term","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"A specific kind of data that can reveal a technique."},"glossary/detection-strategy":{"title":"Detection strategy","type":"Glossary term","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"An approach to detecting a technique, carried out by analytics."},"glossary/group":{"title":"Group","type":"Glossary term","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"A set of related intrusion activity tracked under a name."},"glossary/mitigation":{"title":"Mitigation","type":"Glossary term","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"A security concept or technology that can stop a technique from succeeding."},"glossary/software":{"title":"Software","type":"Glossary term","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"Code an adversary uses: malware, or a tool."},"glossary/tactic":{"title":"Tactic","type":"Glossary term","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"An adversary's goal, the reason for a technique."},"glossary/technique":{"title":"Technique","type":"Glossary term","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"A way an adversary reaches the goal of a tactic."},"playbooks/knowledge-sources":{"title":"Knowledge sources map","type":"Playbook","genre":"reference","label":"nobody has checked this yet, still a draft, a reader disputed this on .github/ISSUE_TEMPLATE","tone":"nobody","definition":"The librarian's scrape map: every repository location and external page this bundle derives concepts from, the concepts each yields, how to re-check each on a refresh run, and the paths left out on purpose."},"playbooks/regenerate-and-test":{"title":"Regenerate and test the schema","type":"Playbook","genre":"how-to","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"How to change the schema: set up with uv and just, edit `src/attack/schema/attack.yaml`, regenerate with `just gen-project`, `just gen-doc` and `just lokf-adapt`, then run `just lint`, where a warning fails, `just test` and the pre-commit hooks."},"playbooks/release":{"title":"Release the schema","type":"Playbook","genre":"how-to","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"How a release is made: semantic-release on a merge to main, from the v0.0.0 baseline tag, so the first release is 0.1.0; only feat, fix, security and breaking commits release, with the `## [Unreleased]` changelog section as the notes, and the knowledge release attaches the adapt copy and the bundle."},"playbooks/update-upstream-pins":{"title":"Update the upstream pins","type":"Playbook","genre":"how-to","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"What to do when the upstream watch reports a newer ATT&CK release, a newer ATT&CK Data Model release or a changed licence, or when lmodel/stix releases: which pins move together in the manifest, the watch, the schema header, the departures list, the stix import test and NOTICE."},"playbooks/validate-data":{"title":"Validate ATT&CK data","type":"Playbook","genre":"how-to","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"How to validate ATT&CK data against the schema: `linkml-validate` with an ATT&CK class for one object or AttackBundle for a bundle, a large release object by object as `just test-attack-data` does, before loading it into the generated models, which check less."},"policies/ai-covenant":{"title":"AI covenant","type":"Policy","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The rules for AI-assisted work here: the contributor owns what they submit, an element says what ATT&CK says, MITRE's data is never edited to pass a test, AI systems post no comments, and the scheduled librarian works only through pull requests a person reviews."},"policies/license-and-attribution":{"title":"Licence and attribution","type":"Policy","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The licences that apply here: Apache 2.0 for the schema and code, MITRE's licence for the copies of ATT&CK's data (with its copyright designation reproduced), Apache 2.0 and OASIS's BSD-3-Clause for the stix modules, MIT for the copier template, and CC BY 4.0 for the knowledge bundle."},"policies/security-policy":{"title":"Security policy","type":"Policy","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"How to report a vulnerability (GitHub's private reporting), which release receives fixes (the latest), what each workflow may do, and what the main branch's ruleset holds: no deletion, no force-push and a linear history; required reviewers on the release Environment and secret scanning are not yet in force."},"references/attack-data-model":{"title":"ATT&CK Data Model","type":"Reference","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"mitre-attack/attack-data-model (the ADM), MITRE's definition of the STIX extensions ATT&CK uses, under the Apache License 2.0; the schema follows release v4.11.7, which MITRE marks as a pre-release, at ATT&CK specification 3.3.0."},"references/attack-stix-data":{"title":"MITRE's ATT&CK STIX data","type":"Reference","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"mitre-attack/attack-stix-data, where MITRE publishes each ATT&CK release as one STIX 2.1 bundle per domain; the schema renders release v20.0 of 13 October 2026, whose data licence lets anyone copy ATT&CK with MITRE's copyright designation and licence."},"references/lmodel-stix":{"title":"lmodel/stix","type":"Reference","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"lmodel/stix, the LinkML schema of STIX 2.1 whose modules the ATT&CK schema imports and extends, and whose adapt copy this schema's copy holds whole."},"services/documentation-site":{"title":"Documentation site","type":"Service","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The knowledge website at `https://lmodel.github.io/attack/`, an Astro Starlight site in `website/` built from the README, `docs/`, the schema's pages and the knowledge bundle, which redirects the retired mkdocs site's addresses and serves the four `lokf export` files under `/knowledge/`."},"workflows/knowledge-librarian":{"title":"Knowledge Librarian (knowledge-librarian.yaml)","type":"Service","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The Knowledge Librarian workflow, `.github/workflows/knowledge-librarian.yaml`: on Mondays it runs the ktl-librarian skill, pinned to v0.59.0, in a job with no write token, and a separate job opens a pull request with the patch; inert until `KNOWLEDGE_LIBRARIAN_ENABLED` is `true`."},"workflows/knowledge-registrar":{"title":"Knowledge Registrar (knowledge-registrar.yaml)","type":"Service","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The Knowledge Registrar workflow, `.github/workflows/knowledge-registrar.yaml`: on a pull request that touches `.lokf/` and on Mondays it validates the bundle with `lokf validate --check-refs` and the conventions script, and checks that each person's confirmation is backed by a review or a signed commit."},"workflows/knowledge-release":{"title":"Knowledge Release (knowledge-release.yaml)","type":"Service","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The Knowledge Release workflow, `.github/workflows/knowledge-release.yaml`: on a published release, once `KNOWLEDGE_RELEASE_ENABLED` is `true`, or by hand, it attaches the bundle zip, the Copilot skill zip and the domain schema as `schema-<tag>-attack.yaml`, each with its `.sha256` and an attestation."},"workflows/knowledge-sync":{"title":"Knowledge sync (knowledge-sync.yaml)","type":"Service","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The Knowledge sync workflow, `.github/workflows/knowledge-sync.yaml`: on Mondays it compares the skills pin with the newest Knowledge Trust Ladder release and, when the pin is behind, opens one pull request that copies the release's templates and moves the pin."},"workflows/knowledge-website":{"title":"Knowledge website (knowledge-website.yaml)","type":"Service","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The Knowledge website workflow, `.github/workflows/knowledge-website.yaml`: it builds the site in `website/` on a push to main, on a pull request that touches its inputs, and on Mondays, and deploys it to GitHub Pages once `KNOWLEDGE_WEBSITE_ENABLED` is `true`."},"workflows/lint-and-docs":{"title":"Lint and docs (lint-and-docs.yaml)","type":"Service","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The Lint & docs workflow, `.github/workflows/lint-and-docs.yaml`: on a push to main, on every pull request and on Mondays, it runs ShellCheck, actionlint, the word budgets of CONTRIBUTING.md (1000) and SECURITY.md (900), markdownlint, the lychee link check and codespell."},"workflows/main":{"title":"Build and test (main.yaml)","type":"Service","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The Build and test workflow, `.github/workflows/main.yaml`: on a push to main and on every pull request, its test job runs `just test` on Python 3.10 to 3.14, and on 3.13 also `just lint` and `just lokf-adapt-check`; its attack-data job fetches the pinned bundles and validates every object."},"workflows/semantic-release":{"title":"Semantic release (semantic-release.yml)","type":"Service","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The Semantic release workflow, `.github/workflows/semantic-release.yml`: on a pull request its plan job previews the release and checks the title, the changelog and the baseline tag; on a push to main its release job, in the release Environment, releases and dispatches the knowledge release."},"workflows/upstream-watch":{"title":"Upstream watch (upstream-watch.yaml)","type":"Service","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The Upstream watch workflow, `.github/workflows/upstream-watch.yaml`: every Monday it runs `scripts/check_upstream_release.py` against MITRE's attack-stix-data and attack-data-model repositories and opens or updates the issue \"Upstream watch: MITRE ATT&CK has changed\" when the check fails."}}