Lion Cipher Lab
Map a threat report to ATT&CK with an LLM — and catch the IDs it invents
- AI Security
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Mapping a threat report to MITRE ATT&CK — turning 'the attacker used PowerShell to download a payload' into 'T1059.001, T1105' — is one of the most common jobs in threat intelligence, and it is slow, fiddly work. So the obvious move in 2026 is to paste the report into a language model and let it do the mapping in seconds. That genuinely works as a first draft, and it is a real productivity win. But there is a trap that catches people every week: a language model is a text predictor, and it will confidently produce technique IDs that look perfect and are wrong — an ID that does not exist at…
What you'll learn
- mapping a threat report to MITRE ATT&CK technique IDs
- using a local LLM (via Ollama) to draft technique mappings from prose
- verifying technique IDs against the official ATT&CK STIX data (enterprise-attack.json)
- catching hallucinated and mis-named technique IDs
- measuring an LLM's precision on a mapping task
- understanding STIX and how the ATT&CK catalog is structured
- judging when an LLM drafting aid fits versus a deterministic tool like MITRE TRAM
Steps in this lab
- What an ATT&CK technique ID is — and why one wrong one poisons everything
- Install Ollama and a small local model
- The report you'll map (synthetic and safe) — and the plan
- Ask the model to extract behaviors and map them to technique IDs
- Get the ground truth: download the official ATT&CK STIX data
- Verify every ID two ways — and catch the hallucination
- Measure the model's precision
- The judgment: draft with the model, finalize with the catalog — and when TRAM wins instead