Loading 0%
Starting…
Tip: Press Ctrl+K to jump to a document.
Living MITRE Repository connecting… live
A living threat repository where real-world incidents are continuously mapped to ATT&CK tactics and techniques, in a Navigator-style view. Filter the data, open a report, highlight its technique chain, and move into Attack Path and Hunt Pack for deeper operational context.
☰ More
Navigator —
Loading…
Navigator Minimap • click tactic to jump
RANK 1highest priority
RANK 2medium priority
RANK 3lower priority
DOC-HITselected-doc technique
OTHERSde-emphasized
Document Details —
Help & Guide Living MITRE Repository

Platform description

The Living MITRE Repository is a threat-intelligence platform that transforms extracted security incident reports into a Navigator-style MITRE ATT&CK view. Incidents are aggregated, correlated, and mapped to ATT&CK tactics and techniques, allowing analysts to move from raw reporting to structured, actionable threat context.

Navigator tactic structure

Reconnaissance • Resource Development • Initial Access • Execution • Persistence • Privilege Escalation • Defense Evasion • Credential Access • Discovery • Lateral Movement • Collection • Command and Control • Exfiltration • Impact.

Technique cards and report linkage

Under each tactic, the platform displays technique cards. Each card represents a MITRE ATT&CK technique associated with one or more real incident reports. Cards show technique ID, technique name, short description, ranking/weight indicators, and a report icon that opens mapped incidents. Selecting a report highlights the ATT&CK technique chain for that incident across the Navigator.

How the platform works

Step 1: Tailor the view
Filter by severity, actor, tool, country, sector, software, breach type, access vector, and other facets.

Step 2: Select time range
Choose the reporting window that fits your investigation.

Step 3: Review the Navigator
Technique cards are arranged by ATT&CK tactic and prioritized visually (Red=Rank 1, Yellow=Rank 2, Blue=Rank 3). Use Expand/Collapse cards to show or hide Top documents for all technique cards at once.

Step 4: Select an incident report
Selecting a report highlights the ATT&CK technique flow for that specific incident in the Navigator.

Step 5: Open Attack Path
View the incident through the Cyber Kill Chain for stage-by-stage operational context.

Step 6: Open Hunt Pack
Get deeper investigative guidance, context, and remediation-oriented information.

Step 7: Continue, refresh, reset, or share
Reset state, review newly available data, use Refresh to load updates, and Share to copy the exact current view for collaboration.
MITRE ATT&CK® is a registered trademark of The MITRE Corporation. This project is not affiliated with or endorsed by MITRE.
Practical Case Studies Operational Value
Loading case studies…
About Open Source

The project

Living MITRE Repository is built for practical threat work: stable technique IDs, evidence you can review quickly, and mappings that stay readable when you”™re moving fast.

The team

Maintained by Hud Seidu Daannaa and contributors.

The goal is simple: keep the platform trustworthy, make the interface feel lightweight, and keep the outputs actionable for detection and response.
MITRE ATT&CK® is a registered trademark of The MITRE Corporation. This project is not affiliated with or endorsed by MITRE.
Quick Switcher
Enter: select ↑/↓: move Esc: close Respects current filters
Updated
➜
Step 1/2

Guided Setup

Welcome to the Living Threat Repository
Why this exists
Cybersecurity produces an enormous amount of intelligence every week.
Reports Threat advisories Incident write-ups Vendor research Blog posts

But there is a fundamental problem.

Most of this intelligence is static.

Once published, it disappears into PDFs, bookmarks, and feeds. Security teams may read it once, extract a few indicators, and move on.

Yet the real purpose of threat intelligence is not simply to inform — it is to improve defensive decisions.

This is why we built something different.

Living Threat Repository website: 🔗 https://thelivingthreat.rabitanoor.com

The idea is simple:

Instead of treating threat intelligence as static documents, the platform treats intelligence as a living structure that can be explored, mapped, and connected.

The repository maps real-world incidents to attacker behavior, allowing security professionals to:

  • Explore how attacks unfold across the MITRE ATT&CK tactics
  • Understand real incidents behind each technique
  • Study attacker behavior instead of isolated indicators
  • Bridge threat intelligence with security operations

The goal is to make threat intelligence operational, not archival.

Think of it as a living knowledge base of real attacks, designed to help analysts, engineers, and defenders understand how threats actually work.

Relevant for teams in
SOC operations Threat hunting Detection engineering Security architecture Cyber threat intelligence
Quick Actions
Jump to Section