ATT&CK Data Model
references/attack-data-modelNobody has checked this yet
still a draft
Written 2026-10-31 by ktl-librarian (automation).
The full record
- Checks
- none recorded
- Sources
- Pointed to by
- Analytic (defined by)
- Asset (defined by)
- ATT&CK domain (defined by)
- ATT&CK ID (defined by)
- attack LinkML schema (derived from)
- Campaign (defined by)
- Data component (defined by)
- Detection strategy (defined by)
- Group (defined by)
- Mitigation (defined by)
- Software (defined by)
- Tactic (defined by)
- Technique (defined by)
- Graph
- Open this concept in the knowledge graph
- IRI
https://w3id.org/lmodel/attack/knowledge/references/attack-data-model- Licence
- CC BY 4.0
- Files
- MarkdownJSON-LDSource on GitHubHistory on GitHub
ATT&CK Data Model
Section titled “ATT&CK Data Model”The ATT&CK Data Model (ADM) defines, as Zod schemas, the objects and properties ATT&CK’s STIX data uses, and documents them on its site.1 The schema follows release v4.11.7, published on 12 May 2026.2
MITRE marks every release of the v4.11 line as a pre-release, published under npm’s next tag, while npm’s latest is v4.10.1. The watch’s comment says the pin follows v4.11.7 all the same, because the schema fixes of v4.11.1 to v4.11.6 match the v20.0 data, which post-dates them.3 No code or text of the ADM is copied here.
Footnotes
Section titled “Footnotes”-
https://github.com/mitre-attack/attack-data-model/releases/tag/v4.11.7 ↩
-
scripts/check_upstream_release.py, the comment beside PINNED_ADM_TAG ↩