mitre_attack_path

MCP tool from Mitre MCP by lidless-labs

Generate possible attack paths through the kill chain

How to use it

Project documentation lists mitre_attack_path for the Mitre MCP MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), then check which tools your installed version makes available. Tool availability can depend on configuration and credentials. A server handshake does not verify this tool’s behavior. See the full listing for setup details.

Install Mitre MCP

$npx -y mitre-mcp
FULL MITRE MCP LISTING

Other tools in Mitre MCP (39)

map-incident-to-attack

Map incident observables to ATT&CK techniques

mitre_campaign_profile

Build a technique profile with group/software/campaign matching

mitre_cortex_analyzer_coverage

Map Cortex analyzers to ATT&CK data sources

mitre_cortex_run_analyzers

Run analyzers on observables with ATT&CK context (write-gated)

mitre_cross_correlate

Search for techniques across Wazuh, TheHive, and MISP simultaneously

mitre_data_version

Get current data version and object counts

mitre_detection_coverage

Analyze detection coverage based on available data sources

mitre_get_campaign

Get campaign details with techniques, software, and groups

mitre_get_datasource

Get data source details with detectable techniques

mitre_get_group

Get group details including techniques and software used

mitre_get_mitigation

Get mitigation details with addressed techniques

mitre_get_software

Get software details with techniques and associated groups

mitre_get_tactic

Get tactic details with all associated techniques

mitre_get_technique

Get full details of a technique by ID (T1059, T1059.001)

mitre_list_campaigns

List all known ATT&CK campaigns

mitre_list_groups

List all known threat groups

mitre_list_tactics

List all tactics in kill-chain order

mitre_map_alert_to_technique

Map security alerts to likely ATT&CK techniques

mitre_map_wazuh_alert

Map Wazuh alerts to ATT&CK techniques by rule ID/description/groups

mitre_misp_create_event

Create events pre-tagged with ATT&CK techniques (write-gated)

mitre_misp_event_to_attack

Map MISP event attributes/galaxies to ATT&CK

mitre_misp_list_events

List events with ATT&CK enrichment

mitre_misp_search_indicators

Search MISP IOCs by technique or group

mitre_mitigations_for_technique

Get all mitigations for a specific technique

mitre_navigator_layer

Generate ATT&CK Navigator JSON layers (coverage, group, campaign, diff)

mitre_search_campaigns

Search campaigns by keyword or technique

mitre_search_groups

Search groups by keyword or technique usage

mitre_search_mitigations

Search mitigations by keyword

mitre_search_software

Search software by name, technique, or type (malware/tool)

mitre_search_techniques

Search techniques by keyword, tactic, platform, data source

mitre_soc_status

Connection status for all SOC integrations

mitre_technique_overlap

Find technique overlap between groups for attribution

mitre_thehive_create_case

Create a case pre-populated with ATT&CK context (write-gated)

mitre_thehive_enrich

Enrich a TheHive case with ATT&CK techniques and mitigations

mitre_thehive_list_cases

List cases with ATT&CK technique filtering

mitre_update_data

Force update of the local ATT&CK data cache

mitre_wazuh_alerts

Fetch recent alerts enriched with ATT&CK context

mitre_wazuh_rule_coverage

Analyze Wazuh rules mapped to ATT&CK techniques

mitre_wazuh_status

Wazuh manager status, agents, and rule stats