Skip to main content

ttp-mapper

The ttp-mapper tool is an AI-powered analysis utility designed for mapping security tools to MITRE ATT&CK techniques through strategic analysis. Within automated security workflows, it enhances threat intelligence by providing actionable insights drawn from various threat reports and online sources.

Ideal Use Cases & Fit​

The ttp-mapper excels in scenarios requiring detailed TTP (Tactics, Techniques, and Procedures) analysis of known threat actors, such as APT groups. It works best with input files containing threat reports in PDF, TXT, or MD formats. The tool helps security teams understand the landscape of threats and strategies used by malicious actors, thus informing better defensive measures. It is less appropriate for real-time analysis as it focuses on comprehensive report analysis and requires time for input processing.

Value in Workflows​

Implementing ttp-mapper in security workflows enhances threat identification and risk assessment capabilities. It is typically utilized during the reconnaissance phase for preemptive threat analysis, as well as in post-processing stages to refine threat intelligence records. By integrating with existing systems, it provides strategic insights that inform mitigation tactics and bolster incident response strategies.

Input Data​

The tool accepts input data in the form of threat reports. The expected formats include:

  • File Formats: PDF, TXT, or MD files
  • Function: Target reports for analysis
  • Required Fields: None
  • Example: report1.pdf,report2.txt

Configuration​

  • threat-actor: Collects and analyzes articles related to a specific threat actor from Feedly.
  • web-reports: Comma-separated URLs or GitHub repositories to analyze, up to a maximum of 10.
  • tram-only: Skips the strategic analysis stage, omitting AI-driven attack chain and mitigation recommendations.

Incorporating these configurable parameters allows users to tailor the tool’s functionality to their specific analytical needs within automated workflows.