MITRE ATT&CK Knowledge Mesh

Mapping method and confidence

The mesh combines four explicitly labelled routes: a technique ID written in a module, an exact technique-name match, a governed topic match, or a conservative tactic-level route. Mappings are built deterministically from the deployed Cyber Knowledge HTML and the official MITRE ATT&CK STIX 2.1 bundle.

• Explicit ID: strongest route; the module contains the ATT&CK identifier.
• Explicit name: the full MITRE technique name appears in the module.
• Topic match: technique vocabulary, tactic, and controlled domain vocabulary overlap.
• Tactic route: broad fallback to a practitioner module that explains the relevant operational phase.

All ATT&CK descriptions, group relationships, mitigations, detection strategies, and analytics remain attributed to MITRE. Cyber Knowledge links provide editorial context authored for 1200km.

Data provenance: ATT&CK content 19.1 · STIX 2.1 bundle build 2026-07-29 · site build 158f6e9d17adb93557ed969cf712dcc64eb042a2. Revoked and deprecated objects are excluded from live matrix entries; old IDs resolve through STIX revoked-by relationships when MITRE publishes a successor.