MITRE ATT&CK objects

The MITRE ATT&CK knowledge base flattened to one row per object — tactics, techniques and sub-techniques, threat groups, software, campaigns and mitigations — with names, platforms, aliases and links.

Table: demo.security.attack_objects
Source: MITRE ATT&CK
Rows
Updated

Query it in Studio Use the OData API

Preview

The first ten rows

Live from the table, no sign-in needed.

SELECT attack_id, object_type, name, tactics, platforms
  FROM demo.security.attack_objects
 LIMIT 10

Example questions

Ask it something

Run any of these here, or open it in Studio to change the SQL. Studio is free to start: 100 queries a day.

What kinds of object does ATT&CK describe?

SELECT object_type, COUNT(*) AS objects
  FROM demo.security.attack_objects
 GROUP BY object_type
 ORDER BY objects DESC

Edit in Studio

Which threat groups are tracked, and what else are they called?

SELECT attack_id, name, aliases
  FROM demo.security.attack_objects
 WHERE object_type = 'group' AND aliases IS NOT NULL
 ORDER BY attack_id
 LIMIT 10

Edit in Studio

Schema

Columns

Column	Type
attack_id	VARCHAR
object_type	VARCHAR
name	VARCHAR
stix_id	VARCHAR
stix_type	VARCHAR
tactics	VARCHAR
platforms	VARCHAR
aliases	VARCHAR
is_subtechnique	BOOL
parent_technique_id	VARCHAR
deprecated	BOOL
revoked	BOOL
modified_at	TIMESTAMP
url	VARCHAR
description	VARCHAR