MITRE Explorer

Threat intelligence agent for MITRE ATT&CK, ATLAS, CVE vulnerabilities, and application security. Query techniques, threat groups, campaigns, software, CVEs (with EPSS exploit-probability scoring), CAPEC attack patterns, GHSA + OSV advisories (OSS packages, OS, distros, kernel, Android), detection strategies, and compliance mappings across Enterprise, ICS, Mobile, and ATLAS domains. The same tools are also served over MCP at https://mitre-explorer.org/api/mcp: no key, no sign-up, no fixed rate limit.

Skills

• CVE Vulnerability Lookup
  Search and retrieve CVE vulnerability details including CVSS scores, severity, CWEs, EPSS exploit-probability scores (First.org, daily refreshed), CAPEC attack patterns, affected applications, linked ATT&CK techniques, CISA KEV status, GHSA package advisories, and OSV OS/distro advisories (Linux kernel, Debian, Ubuntu, Alpine, Android, Rocky, Alma, SUSE, OSS-Fuzz) that alias the CVE. Covers more than 398,000 CVEs, 1999 on.
  cvevulnerabilitysecuritycvssepsscapecosvcisa-kev
• ATT&CK Technique Intelligence
  Get detailed intelligence on ATT&CK and ATLAS techniques: threat groups using them, Sigma detection rules, Atomic Red Team tests, D3FEND countermeasures, affected applications, NIST 800-53 control mappings, and CAPEC attack patterns mapped to the technique.
  techniqueattackatlasdetectionsigmad3fendcapec
• Threat Hunting Card
  One hunting card per ATT&CK technique: a starting hypothesis built from ATT&CK data by a fixed template, the logs to collect, detection strategies and analytics, the top Sigma rules, one Atomic Red Team test to check the detection, indicators from the last 14 days and recent reports. A parent technique includes its sub-techniques. ATT&CK techniques only, not ATLAS.
  huntthreat-huntingdetectionsigmaatomicsoc
• Threat Group Profile
  Retrieve threat actor group profiles with their techniques, targeted sectors, software used, campaigns, and targeted applications. Covers more than 180 ATT&CK groups plus more than 500 ETDA/ThaiCERT external actors.
  threat-groupaptadversaryactor
• Application Vulnerability Assessment
  Check the security posture of more than 119,000 vendor products. Returns CVEs, CWE weakness profile, reachable ATT&CK techniques, and associated threat groups via the CVE-CWE-CAPEC-ATT&CK chain.
  applicationsoftwarecpevulnerabilityattack-surface
• Sector Threat Landscape
  Analyze threats to industry sectors: groups targeting the sector, their techniques, campaigns, vulnerable applications, and associated CVEs. Covers 12 sectors including Financial, Healthcare, Government, Energy, Telecom.
  sectorindustrythreat-landscape
• ATT&CK Statistics
  ATT&CK in numbers: technique, group, software, campaign, mitigation and data source counts, the top groups, the ten techniques live groups use most, the sector breakdown and the loaded ATT&CK version. Filtered by domain or sector. ATT&CK entities only: no CVE, advisory or CAPEC totals.
  dashboardstatisticsattackoverview
• Detection & Compliance Search
  Search Sigma rules (3,100+), Atomic Red Team tests (1,900+), D3FEND countermeasures (156), NIST 800-53 controls (5,200+), MITRE Engage mappings, VERIS mappings, and cloud security controls for Azure and GCP. Lists CIS Controls v8.1 (8.1.2) Safeguards with their Implementation Groups, as CIS maps them to ATT&CK in the CIS Community Defense Model (CDM) v3.0, and the CIS gaps of an ATT&CK group or technique list: each technique under the lowest Implementation Group whose Safeguards mitigate it, else notMitigated or notAssessed. CIS text and CIS's ATT&CK mapping: CC BY-NC-ND 4.0, non-commercial use only, attribution required. CIS titles and descriptions are served exactly as the CDM v3.0 workbook writes them; cisSource carries the source, license and attribution.
  sigmadetectionnistcomplianced3fendatomiccis-controls
• Threat Intelligence Reports
  Access recent CTI reports from AlienVault OTX, DFIR Report, Unit42, Microsoft Security, and Talos. Reports are mapped to ATT&CK techniques with IOC indicators.
  ctithreat-reportotxioc
• Cross-Domain Entity Search
  Search across all entity types (techniques, groups, software, campaigns, mitigations, data sources, applications) in all domains (Enterprise, ICS, Mobile, ATLAS).
  searchentitycross-domain
• Malware & Tool Analysis
  Search and profile 971 malware families and attacker tools. Get techniques, groups using them, campaigns, and platform coverage.
  malwaretoolsoftwarecobalt-strike
• Campaign Intelligence
  Search and analyze 61 named campaigns with timelines, techniques, software, and threat groups involved.
  campaignoperationtimeline
• Mitigation Guidance
  Search 153 mitigations and get specific countermeasure guidance for ATT&CK techniques.
  mitigationdefensecountermeasure
• ATT&CK Tactic Profile
  One ATT&CK tactic: its description, its domain and every live technique and sub-technique under it. Deprecated tactics are flagged.
  tacticattacktechnique
• ATT&CK Data Source Profile
  One ATT&CK data source: its description, its data components and the techniques it can detect. ATT&CK has marked every data source deprecated since v18. Components are matched to their source by name.
  data-sourcedata-componentdetectiontelemetry
• IOC Feed Search
  Search more than 230,000 IOCs (IPs, domains, hashes, URLs, CVEs) with VirusTotal verdicts and malware family attribution. Sources: OTX, ThreatFox, MalwareBazaar, CISA KEV.
  iocindicatorhashipdomainvirustotal
• Sigma Detection Rules
  Search 3,100+ Sigma rules by keyword, technique, or severity. Get YAML rule details for SIEM deployment.
  sigmadetectionsiemrule
• Atomic Red Team Tests
  Search 1,900+ Atomic Red Team tests for adversary emulation. Filter by technique, platform, and executor type.
  atomicred-teamemulationtesting
• External Threat Actor Profiles
  Search more than 500 threat actors from ETDA/ThaiCERT with country attribution, state sponsors, motivation, suspected victims, and MITRE ATT&CK group mappings.
  actorattributioncountrystate-sponsor
• OWASP Top 10 Analysis
  Get OWASP Top 10 categories for Web (2021), ML (2023), and LLM (2025) security risks mapped to ATT&CK + ATLAS techniques via CWE.
  owasptop10web-securityappseccomplianceml-securityllm-securityai-risks
• GitHub Security Advisory Detail
  Get full details for a GitHub Security Advisory: summary, description, CVSS v3/v4, CWEs, CAPEC attack patterns, affected open-source packages with vulnerable/fixed version ranges, linked ATT&CK techniques.
  ghsagithubadvisoryappsecvulnerabilitiessupply-chaincapec
• Package Vulnerabilities
  List vulnerabilities affecting a specific open-source package in an ecosystem (npm, pypi, go, maven, rubygems, nuget, composer, rust). Returns all GHSAs with vulnerable/fixed version ranges and linked ATT&CK techniques.
  packagesnpmpypigomavensupply-chainappsecvulnerabilities
• Search GitHub Security Advisories
  Search GHSA advisories by keyword, severity, ecosystem, or publication date. Returns summary, severity, affected ecosystems, linked CVEs.
  ghsagithubadvisorysearchvulnerabilities
• CVE to Affected Packages
  Given a CVE ID, return the open-source packages affected via its GitHub Security Advisory alias. Returns ecosystem, package name, vulnerable range, fixed version.
  cvepackagesghsasupply-chainremediation
• CAPEC Attack Pattern Detail
  Get a specific MITRE CAPEC attack pattern (CAPEC-N) with full taxonomy: description, abstraction (Meta/Standard/Detailed), severity, likelihood, prerequisites, skills required, resources required, consequences, example instances, linked CWEs, mapped ATT&CK techniques, mitigations, and related patterns (ChildOf/ParentOf/CanPrecede/CanFollow). 615 patterns from the CAPEC STIX 2.1 corpus.
  capecattack-patterncweadversary-modellingthreat-modelling
• Search CAPEC Attack Patterns
  Search/filter CAPEC attack patterns by keyword, abstraction level (Meta, Standard, Detailed), severity (Very Low..Very High), or likelihood (Low, Medium, High). Returns CAPEC ID, name, taxonomy fields, CWE references, and technique/mitigation counts.
  capecattack-patternsearchthreat-modelling
• Unified Advisories Search
  Search across GHSA (GitHub Security Advisories — OSS packages: npm/PyPI/Maven/Go/NuGet/RubyGems/Composer/crates.io/Pub/Hex) AND OSV (OS + distro + kernel: Linux kernel, Debian, Ubuntu, Alpine, Android, Red Hat, Rocky Linux, AlmaLinux, SUSE, openSUSE, OSS-Fuzz, Bitnami, Chainguard, Wolfi, Hackage, CRAN, Julia). Filter by source, severity, ecosystem, date range, or CVE-alias presence. Returns one row per advisory with a source badge — no duplicates: our OSV ingest skips GHSA-covered ecosystems at fetch time and drops records aliasing existing GHSA rows.
  advisoriesghsaosvvulnerabilitieslinuxdebianubuntualpineandroidkerneldistros
• OSV Advisory Detail
  Get full details for an OSV advisory (OS / distro / kernel) by native ID (DSA-*, USN-*, LBSEC-*, ALAS-*, KERN-*, RLSA-*, etc.): summary, description, aliases (CVE/GHSA), CVSS score + vector, affected packages grouped by ecosystem with vulnerable version ranges. Source: osv.dev — ingested daily with 7-day rolling delta and monthly full reconcile.
  osvadvisorylinuxdebianubuntualpineandroidkerneldistros
• Compliance Frameworks (SCF-backed)
  Bridge between MITRE ATT&CK and regulatory / audit frameworks via the Secure Controls Framework (SCF). Cross-walks 240+ frameworks — NIS2, DORA, PCI DSS v4, ISO 27002:2022, HIPAA Security Rule, GDPR, NIST 800-53 r5, NIST CSF v2, CMMC 2.0, FedRAMP r5, NERC CIP, IEC 62443, UK Cyber Essentials, AU Essential Eight, NIST AI RMF, EU CRA, EU AI Act, OWASP Top 10, and more — to ATT&CK techniques. Answer GRC questions like 'which techniques does NIS2 cover?' or 'if I mitigate T1059, which compliance regimes do I satisfy?'. Each framework rolls up to 1,591 SCF controls with article/section-level cross-references. Checked monthly; SCF itself releases twice a year. Powered by SCF — CC BY-ND 4.0.
  complianceregulatoryscfnis2dorapci-dssiso-27002hipaagdprnist-800-53cmmcfedrampnerc-cipiec-62443owasp-top-10eu-ai-acteu-cragrc
• ICS Assets and Purdue Model
  The 18 ATT&CK for ICS assets (A0001 to A0018: PLCs, RTUs, safety controllers, historians, HMIs, workstations, field I/O), the ICS techniques that target each, and their place on the Purdue model: levels L0 to L5, the industrial DMZ at L3.5 and the 42 level-to-level flows. Searched by name, Purdue level, zone, sector or IT/OT boundary. The Purdue placement is curated from NIST SP 800-82r3 and ISA-95, not published by MITRE.
  icsics-assetpurdueotisa-95

How to call

https://mitre-explorer.org/api/a2a

Listed in

Directories this entry was found in.