What can I automate with the MITRE ATT&CK integration?

Work with MITRE ATT&CK, the standard catalogue of how adversaries actually behave, read straight from MITRE's own TAXII server. Browse and search the Enterprise, Mobile and ICS matrices by tactic, platform or free text; read any technique, group, campaign, piece of malware or mitigation in full; and follow the links between them, so a technique comes back with the mitigations and detections that cover it and the groups seen using it, and a group comes back with everything it deploys. Check what a release changed, list the telemetry a detection would need, read the raw STIX behind any entry, and export a filtered technique list as CSV. No account or API key required. Lodol supports 20 actions for MITRE ATT&CK, which you can combine with any other app in a workflow.

How do I connect MITRE ATT&CK to Lodol?

Connect MITRE ATT&CK once in your workspace and every action and trigger it supports can be added to a workflow, by you in the editor or by your AI.

All integrationsSecurity

MITRE ATT&CK

Work with MITRE ATT&CK, the standard catalogue of how adversaries actually behave, read straight from MITRE's own TAXII server.

Start Free Browse all integrations

actions: 20

Actions

Steps a workflow can run in MITRE ATT&CK.

Filter MITRE ATT&CK actions

List ATT&CK domainsList the three ATT&CK knowledge bases MITRE publishes (Enterprise, Mobile and ICS) with what each covers and whether the server is serving it. Every other action takes one of these as its domain, so this is the place to start when you are not sure which matrix a question belongs to. No API key required.
Get domain detailsRead which ATT&CK release a domain is currently on, when it was published, and how much it holds: the number of techniques, tactics, groups, software entries, campaigns, mitigations, data sources and detection strategies. Run it to check for a new release before doing anything else; ATT&CK ships a few times a year and an answer read either side of one can differ. No API key required.
List tacticsList a domain's tactics (the adversary goals that make up the columns of the ATT&CK matrix, from Reconnaissance through to Impact) in the matrix's own left-to-right order, with how many techniques sit under each. This is the top level of ATT&CK, and the natural first step when walking the matrix. No API key required.
Get a tacticRead one tactic and every technique filed under it: the whole column of the matrix in one step. Use it to answer 'what can an adversary do to achieve persistence here', or to feed a coverage review one goal at a time. No API key required.
List techniquesBrowse a domain's techniques through every filter ATT&CK supports: tactic, platform, whether to include sub-techniques, and free text over IDs, names and descriptions. Order the results and page through them. This is the general-purpose browse action: 'every macOS technique under Credential Access' is one step. No API key required.
Get a techniqueRead one technique in full: what the behaviour is, which tactics it serves, which platforms it applies to, its parent and sub-techniques, and MITRE's sources. With related objects included it also returns the mitigations and detection strategies that cover it and the groups, software and campaigns observed using it, each with MITRE's procedure example. Give it an ATT&CK ID like T1059 or T1059.001. No API key required.
Search ATT&CKSearch a whole domain for a word, name, alias or ATT&CK ID and get the best matches first, across techniques, groups, software, campaigns, mitigations, data sources and detection strategies at once. A hit on the ATT&CK ID outranks one on the name, which outranks an alias, which outranks a word buried in a description, and each result says which fields it matched on. Use it when you have a term from a report rather than an ID. No API key required.
List groupsList the adversary groups ATT&CK tracks in a domain, each with every name it is known by: the vendor aliases such as Cozy Bear or Midnight Blizzard that a report is far more likely to use than G0016. Filter by free text over IDs, names, aliases and descriptions. No API key required.
Get a groupRead one adversary group: who MITRE says they are, every name they are tracked under, and the reporting behind it. With related objects included it also returns the techniques they use (each with MITRE's procedure example describing how they used it), the malware and tools they deploy, and the campaigns attributed to them. This is the action behind 'what does APT29 actually do'. No API key required.
List softwareList the malware and tools ATT&CK tracks in a domain. Malware is adversary-built code; tools are legitimate software adversaries repurpose, such as PsExec. Filter to one or the other, narrow by platform, and search by name, alias or description. No API key required.
Get softwareRead one piece of malware or tooling: what it is, which platforms it runs on, and every name it is tracked under. With related objects included it also returns the techniques it implements and the groups and campaigns observed deploying it: the answer to 'if we found Cobalt Strike, who uses it and what will they do next'. No API key required.
List mitigationsList the mitigations ATT&CK recommends in a domain: the defensive measures (multi-factor authentication, application control, network segmentation) that its techniques are mapped to. Filter by free text over IDs, names and descriptions. No API key required.
Get a mitigationRead one mitigation and, with related objects included, every technique it defends against, which is how a control you already run turns into a list of the adversary behaviour it covers. No API key required.
List campaignsList the intrusion campaigns ATT&CK tracks in a domain (named sets of activity such as Operation Ghost or SolarWinds Compromise) with when each was first and last reported active. A campaign is the bridge between a group and a specific intrusion. No API key required.
Get a campaignRead one campaign: what happened, when it ran, and every name it is reported under. With related objects included it also returns the group it is attributed to and the techniques and software it used. No API key required.
List data componentsList the telemetry ATT&CK expects detections to be built on: the events a detection consumes (Process Creation, Network Connection Creation, Logon Session Metadata) each with the concrete logs it can be read from, down to the channel ('WinEventLog:Security' / 'EventCode=4688'). Filter to one log source to answer 'what can I detect with the telemetry I already collect'. No API key required.
List related objectsWalk the relationships around any ATT&CK entry, in both directions, grouped by how they are linked. This is the action behind 'which groups use this technique', 'what does this malware do', 'what mitigates this' and 'which campaigns has this group run': the joins that make ATT&CK a graph rather than a list. Narrow it to particular link types or object kinds, and keep or drop MITRE's procedure examples. No API key required.
List recent changesList what a domain gained or revised after a date and time: the new techniques, newly tracked groups and revised entries of the last release. This is the one question MITRE's server answers itself rather than leaving to be filtered, so it is the cheap way to run 'tell me what changed' on a schedule and only act when something did. No API key required.
Get raw STIX objectRead one entry exactly as MITRE publishes it (the whole STIX 2.1 object, untouched) beside the date the collection took it in and every version it holds. The other actions return a tidied record; use this one when feeding a STIX-aware tool, or to see a field this integration does not surface. No API key required.
Export techniques as CSVWrite a filtered technique list out as CSV: the same filters as the browse action, rendered as a spreadsheet a workflow can attach to an email, upload to a drive, or hand to a coverage review. One row per technique with its ATT&CK ID, name, tactics, platforms, parent and description. No API key required.