Your files stay on your device

MITRE ATT&CK mapper

Paste incident notes or Sigma tags and get ATT&CK technique suggestions with evidence, exported as a Navigator layer.
Add techniqueImport a Navigator layer (.json)

Paste notes or add an id, and matching techniques appear here with the evidence that triggered them.

This is a deterministic matcher, not an AI classifier: the same text always yields the same suggestions. Technique IDs, Sigma tags, manually added ids and imported layer entries count as high-confidence and start reviewed. Curated incident phrases and verbatim technique names are suggestions only; tick the ones your report stands behind. Revoked ids map to their replacements with a note, and ones with no replacement are dropped with a note instead of guessed. The bundled snapshot tracks retired techniques; it does not carry MITRE's separate deprecated attribute. The v20 split of the old Defense Evasion tactic into Stealth and Defense Impairment applies, so older layers placed under defense-evasion will not match.
Options

More network tools

- CloudTrail analyzer (/network/aws-cloudtrail-log-analyzer)
All network tools (/network)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/network/mitre-attack-mapper
Markdown version: https://nutter.tools/network/mitre-attack-mapper.md
Plain-text version: https://nutter.tools/network/mitre-attack-mapper.txt
Agent index: https://nutter.tools/llms.txt