--- title: MITRE ATT&CK (PyAttck) slug: connectors/mitre-attandck-pyattck docTags: createdAt: 2026-06-09T16:29:52.143Z --- ## Swimlane Pyattck Connector The MITRE ATT\&CK (PyAttck) connector enables automated interaction with the MITRE ATT\&CK framework using the PyAttck library. MITRE ATT\&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The PyAttck connector allows Swimlane Turbine users to seamlessly integrate this intelligence into their security automation workflows. By leveraging this integration, users can enhance their threat detection and response capabilities, automate the retrieval of threat actor, malware, and technique data, and generate formatted intelligence for use in security operations. This empowers security teams to make informed decisions and respond swiftly to threats, improving overall security posture. ## Swimlane Pyattck Connector pyattck is a light-weight python package to retrieve actors, malware, mitigations, tactics, techniques and tools from MITRE ATT\&CK Frameworks. With pyattck you can access data from the Enterprise, Mobile, and PRE-ATT\&CK MITRE ATT\&CK Frameworks. Additionally, you have access to external data which provides more rich context like the ability to retrieve potential commands, queries, and detections for techniques. Actors and Tools also have additional contextual data available. This connector pulls information from Swimlane's open-source project, pyattck. ## Prerequisites Before you can use the MITRE ATT\&CK (PyAttck) connector for Turbine, ensure the following prerequisites are met: - Access to the MITRE ATT\&CK framework via the PyAttck library. - No additional parameters are required for this integration. ## Capabilities Each task in this Connector allows you to retrieve all named objects (e.g. Actors, Malwares, etc.) as well as filter based on property values of related object types. Additionally, you can select which MITRE ATT\&CK Framework to pull data from (default is enterprise). This connector provides the following tasks: - Get Actors - Get Controls - Get Malwares - Get Mitigations - Get Tactics - Get Techniques - Get Tools - Get Data ## Notes - [MITRE ATT\&CK](https://attack.mitre.org/) - [pyattck source code](https://github.com/swimlane/pyattck) - [pyattck docs](https://pyattck.readthedocs.io/en/latest/) # Configurations ## MITRE ATT\&CK (PyAttck) Authentication Retrieve informaton about MITRE ATT\&CK via Swimlane's open-source project pyattck. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ----------------------- | -------------------------------------------------------- | -------- | ------------ | | nested\_subtechniques | Whether or not to nest subtechniques. Defaults to False. | boolean | Optional | | enterprise\_attck\_json | The location of the Enterprise ATT\&CK Json. | string | Optional | | pre\_attck\_json | The location of the Pre-ATT\&CK Json. | string | Optional | | mobile\_attck\_json | The location of the Mobile ATT\&CK Json. | string | Optional | | ics\_attck\_json | The location of the ICS ATT\&CK Json. | string | Optional | | nist\_controls\_json | The location of the NIST 800-53 Controls Json. | string | Optional | | generated\_attck\_json | The location of the Generated Contextual ATT\&CK Json. | string | Optional | | generated\_nist\_json | The location of the Generated NIST Json. | string | Optional | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Get Actors Retrieve a list of threat actors from the MITRE ATT\&CK framework using the PyAttck connector. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ------------------------ | | `attack_framework` | string | Optional | Parameter for Get Actors | | `match_malware` | string | Optional | Parameter for Get Actors | | `match_malware_name` | string | Optional | Name of the resource | | `match_malware_id` | string | Optional | Unique identifier | | `match_technique` | string | Optional | Parameter for Get Actors | | `match_technique_name` | string | Optional | Name of the resource | | `match_technique_id` | string | Optional | Unique identifier | | `match_tool` | string | Optional | Parameter for Get Actors | | `match_tool_name` | string | Optional | Name of the resource | | `match_tool_id` | string | Optional | Unique identifier | ### Input Example `{"attack_framework":"enterprise","match_malware":"AutoIt backdoor","match_malware_name":"4H RAT","match_malware_id":"S0331","match_technique":"Stored Data Manipulation","match_technique_name":"System Shutdown/Reboot","match_technique_id":"T1059","match_tool":"PsExec","match_tool_name":"PsExec","match_tool_id":"S0190"}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Get Controls Provides detailed information on compliance controls associated with MITRE ATT\&CK Framework techniques. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | -------------------------- | | `match_technique` | string | Optional | Parameter for Get Controls | | `match_technique_name` | string | Optional | Name of the resource | | `match_technique_id` | string | Optional | Unique identifier | ### Input Example `{"match_technique":"Stored Data Manipulation","match_technique_name":"System Shutdown/Reboot","match_technique_id":"T1059"}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Get Data Obtain all or specific data from the MITRE ATT\&CK dataset using the PyAttck connector. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ---------------------- | | `type` | string | Optional | Type of the resource | | `attack_framework` | string | Optional | Parameter for Get Data | ### Input Example `{"type":"all","attack_framework":"enterprise"}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Get Formatted String from Array Generate a formatted string for Swimlane use cases and widgets from an array of technique names or IDs. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `attack_framework` | string | Optional | MITRE ATT\&CK domain to load (enterprise, preattack, or mobile). Determines which dataset is used to resolve techniques and tactics. | | `techniques` | array | Optional | List of technique IDs (e.g. T1059, T1055.011) or exact technique display names to format. For subtechnique IDs, the parent technique is used for lookup. Each matching item yields one or more "Tactic / Technique" strings per tactic associated with the technique. | ### Input Example `{"attack_framework":"enterprise","techniques":["T1055.011"]}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"formatted_results":["Privilege Escalation / Process Injection","Defense Evasion / Process Injection","Defense Evasion / Debugger Evasion"]}}` ## Get Formatted Tactic and Technique String Generate a formatted string of MITRE ATT\&CK tactic and technique for Swimlane widgets using a specified technique ID. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ------------------------------------------------------- | | `technique_id` | string | Required | Unique identifier | | `attack_framework` | string | Optional | Parameter for Get Formatted Tactic and Technique String | | `tactic_id` | string | Optional | Unique identifier | ### Input Example `{"technique_id":"T1059.002","attack_framework":"enterprise","tactic_id":123}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Get Malwares Retrieve malware objects from the MITRE ATT\&CK framework using the PyAttck connector. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | -------------------------- | | `attack_framework` | string | Optional | Parameter for Get Malwares | | `match_actor` | string | Optional | Parameter for Get Malwares | | `match_actor_name` | string | Optional | Name of the resource | | `match_actor_id` | string | Optional | Unique identifier | | `match_technique` | string | Optional | Parameter for Get Malwares | | `match_technique_name` | string | Optional | Name of the resource | | `match_technique_id` | string | Optional | Unique identifier | ### Input Example `{"attack_framework":"enterprise","match_actor":"APT1","match_actor_name":"APT33","match_actor_id":"G0005","match_technique":"Stored Data Manipulation","match_technique_name":"System Shutdown/Reboot","match_technique_id":"T1059"}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Get Mitigations Obtain a list of mitigation strategies and techniques from the MITRE ATT\&CK framework. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------- | | `attack_framework` | string | Optional | Provide enterprise or mobile to retrieve data from those ATT\&CK frameworks. Default is enterprise. | | `match_technique` | string | Optional | Provide a property value for a given technique and return mitigations for that technique. | | `match_technique_name` | string | Optional | Provide the name of a technique and return mitigations for that technique. | | `match_technique_id` | string | Optional | Provide the MITRE ATT\&CK ID of a technique and return mitigations for that technique. | ### Input Example `{"attack_framework":"enterprise","match_technique":"Stored Data Manipulation","match_technique_name":"System Shutdown/Reboot","match_technique_id":"T1059"}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | ------------------------------------- | | `mitigations` | array | Output field: mitigations | | `mitigations.id` | string | Unique identifier | | `mitigations.name` | string | Name of the resource | | `mitigations.description` | string | Output field: mitigations.description | ### Output Example `{"mitigations":[{"id":"M1017","name":"User Training","description":"Train users to be aware of access or manipulation attempts by an adversary to reduce the risk of successful spearphishing, social engineering, and other techniques that involve user interaction."},{"id":"M1032","name":"Multi-factor Authentication","description":"Use two or more pieces of evidence to authenticate to a system; such as username and password in addition to a token from a physical smart card or token generator."},{"i...` ## Get Tactics Obtain a list of tactic objects from the MITRE ATT\&CK framework using the PyAttck connector. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ------------------------- | | `attack_framework` | string | Optional | Parameter for Get Tactics | | `match_technique` | string | Optional | Parameter for Get Tactics | | `match_technique_name` | string | Optional | Name of the resource | | `match_technique_id` | string | Optional | Unique identifier | ### Input Example `{"attack_framework":"enterprise","match_technique":"Stored Data Manipulation","match_technique_name":"System Shutdown/Reboot","match_technique_id":"T1059"}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Get Techniques Access additional relationships and details within the MITRE ATT\&CK Frameworks using the Get Technique action. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ---------------------------- | | `attack_framework` | string | Optional | Parameter for Get Techniques | | `match_actor` | string | Optional | Parameter for Get Techniques | | `match_actor_name` | string | Optional | Name of the resource | | `match_actor_id` | string | Optional | Unique identifier | | `match_control` | string | Optional | Parameter for Get Techniques | | `match_control_name` | string | Optional | Name of the resource | | `match_control_id` | string | Optional | Unique identifier | | `match_mitigation` | string | Optional | Parameter for Get Techniques | | `match_mitigation_name` | string | Optional | Name of the resource | | `match_mitigation_id` | string | Optional | Unique identifier | | `match_tactic` | string | Optional | Parameter for Get Techniques | | `match_tactic_name` | string | Optional | Name of the resource | | `match_tactic_id` | string | Optional | Unique identifier | ### Input Example `{"attack_framework":"enterprise","match_actor":"APT1","match_actor_name":"APT33","match_actor_id":"G0005","match_control":"Provenance","match_control_name":"Spam Protection","match_control_id":"SR-5","match_mitigation":"M1036","match_mitigation_name":"System Shutdown/Reboot","match_mitigation_id":"M1040","match_tactic":"Account Discovery","match_tactic_name":"System Shutdown/Reboot","match_tactic_id":"TA0003"}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Get Tools Obtain tool objects from MITRE ATT\&CK, including attributes and relationships relevant to the tools. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ----------------------- | | `attack_framework` | string | Optional | Parameter for Get Tools | | `match_actor` | string | Optional | Parameter for Get Tools | | `match_actor_name` | string | Optional | Name of the resource | | `match_actor_id` | string | Optional | Unique identifier | | `match_technique` | string | Optional | Parameter for Get Tools | | `match_technique_name` | string | Optional | Name of the resource | | `match_technique_id` | string | Optional | Unique identifier | ### Input Example `{"attack_framework":"enterprise","match_actor":"APT1","match_actor_name":"APT33","match_actor_id":"G0005","match_technique":"Stored Data Manipulation","match_technique_name":"System Shutdown/Reboot","match_technique_id":"T1059"}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |