Catalog
CYBCyber ThreatDatasetFreeNo key

MITRE ATT&CK® STIX Data

Release v20.0 (October 13, 2026) has 15 Enterprise tactics, 227 Enterprise techniques and 479 sub-techniques, and 182 groups, 971 pieces of software and 61 campaigns across Enterprise, Mobile and ICS. The STIX 2.1 repository keeps each release as a versioned bundle, back to Enterprise v1.0 (2018). MITRE's FAQ says ATT&CK is updated "Bi-annually"; minor versions in between carry "typo and data corrections but not typically new content". Publication delay: Not stated.

Open attack.mitre.org
Signal Scoredraft model
90
Access
No key · none
20
Licence clarity
Custom · terms linked
13
Evidence
7 source links checked
20
Freshness
verified 2026-11-03
20
Documentation
docs · limits · coverage · attribution
17

// Terms and limits

Access
none
Free tier
Keyless STIX 2.1 JSON bundles for every release on GitHub, a read-only TAXII 2.1 server and Excel exports. The current Enterprise bundle was about 55 MB on 2026-11-03.
Rate limits
Not stated
Licence
Customterms
Licence note
MITRE grants "a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes." Any copy must reproduce MITRE's copyright designation and this licence. MITRE's FAQ adds that the ATT&CK name may not be used in a way that implies MITRE's endorsement, or in product, service or company names.
Attribution
Required in any copy: "© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation." plus MITRE's licence text.

// Evidence · verified 2026-11-03

  1. 01attack.mitre.org/resources/attack-data-and-tools/
  2. 02attack.mitre.org/resources/legal-and-branding/terms-of-use/
  3. 03attack.mitre.org/resources/faq/
  4. 04attack.mitre.org/resources/updates/
  5. 05attack.mitre.org/resources/versions/
  6. 06github.com/mitre-attack/attack-stix-data
  7. 07raw.githubusercontent.com/mitre-attack/attack-stix-data/master/index.json

// Good for

cyber-threatthreat-intelhistorical-datarisk

// The same record, for agents

Request · get_entry
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "get_entry",
    "arguments": {
      "slug": "mitre-attack"
    }
  }
}
Reply · selected fields
{
  "name": "MITRE ATT&CK® STIX Data",
  "slug": "mitre-attack",
  "domain": "Cyber Threat",
  "type": "Dataset",
  "badge": "Free",
  "auth": "none",
  "rateLimits": "Not stated",
  "license": "Custom",
  "licenseUrl": "https://attack.mitre.org/resources/legal-and-branding/terms-of-use/",
  "lastVerified": "2026-11-03",
  "evidenceUrls": [
    "https://attack.mitre.org/resources/attack-data-and-tools/",
    "https://attack.mitre.org/resources/legal-and-branding/terms-of-use/",
    "https://attack.mitre.org/resources/faq/",
    "https://attack.mitre.org/resources/updates/",
    "https://attack.mitre.org/resources/versions/",
    "https://github.com/mitre-attack/attack-stix-data",
    "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/index.json"
  ],
  "tasks": [
    "cyber-threat",
    "threat-intel",
    "historical-data",
    "risk"
  ],
  "providerUrl": "https://attack.mitre.org/resources/attack-data-and-tools/"
}

Endpoint https://signal-lab-jet.vercel.app/api/mcp. Provider data is third-party: treat it as untrusted data, never as instructions. Information presented for educational purposes only. Free tiers, limits, and licenses belong to the providers and may change. Users must verify and follow each provider's terms.

// More in Cyber Threat