Lion Cipher Lab
Query the raw MITRE ATT&CK STIX dataset in Python: from a threat group to the telemetry that detects it
- Threat Intel Analyst
- Intermediate
- ~90 min
- Free · no account required
Why it matters
Every threat-intel and detection team eventually asks the same practical question: 'this group is targeting our sector, which of its techniques could we actually see with the logs we collect?' The ATT&CK website answers it one page at a time; the dataset behind the website answers it in seconds, for any group, in a form you can diff, automate and put in a report. But the raw data has traps that quietly produce wrong answers. Objects are kept forever and marked revoked or deprecated rather than deleted, so an ID from a 2019 report still 'exists'. A group's behaviour lives on three different…
What you'll learn
- Downloading and PINNING a specific ATT&CK release from the official attack-stix-data repository
- Reading a STIX 2.1 bundle as a graph: objects, relationships, source_ref and target_ref
- Resolving a group by its stable ATT&CK ID (G0016) rather than by a name or alias
- Collecting a group's techniques along all three paths: direct, campaign-attributed and software-inherited
- Handling revoked and deprecated objects, and following revoked-by to translate legacy technique IDs
- Walking the post-v18 detection model: detection strategy -> analytic -> data component
- Measuring telemetry coverage two ways (loose vs strict) and naming the components that would close the most gaps
Steps in this lab
- What you are about to query, and why not just use the website
- Download a PINNED release, not 'the latest'
- Inventory the bundle, and meet the encoding trap
- Walk a group's techniques along all three paths
- Where revoked objects really bite: IDs from an old report
- The v18 detection model: strategy, analytic, data component
- Score coverage against the telemetry you actually collect
- What these numbers do and do not mean (the judgement)
- Pinning, measured, and where to go next