Mitre MCP
未认领MCP server for the MITRE ATT&CK knowledge base: map alerts to techniques, profile threat groups, analyze detection coverage, and enrich SOC workflows from an AI client.
01 / 选择客户端
03 / 添加配置
claude mcp add --transport stdio 'lidless-labs-mitre-mcp' -- 'npx' '-y' 'mitre-mcp'04 / 在客户端中确认
打开客户端的 MCP 设置，确认服务器已连接并列出工具。复制配置不代表连接成功。
更多AI & ML服务器
浏览完整目录安全概况
已认领和已认证的服务器每周接受一次静态扫描，显示代码能触及的范围（外部服务、环境变量、shell 命令、代理配置目录）以及带有已知公告的依赖。认领此列表即可获得。 安全概况的工作原理
40 个工具中显示 40 个
文档中列出的工具 (40)
内容来自项目文档。服务器握手不会验证每个工具的说明或行为。
map-incident-to-attack
Map incident observables to ATT&CK techniques
mitre_attack_path
Generate possible attack paths through the kill chain
mitre_campaign_profile
Build a technique profile with group/software/campaign matching
mitre_cortex_analyzer_coverage
Map Cortex analyzers to ATT&CK data sources
mitre_cortex_run_analyzers
Run analyzers on observables with ATT&CK context (write-gated)
mitre_cross_correlate
Search for techniques across Wazuh, TheHive, and MISP simultaneously
mitre_data_version
Get current data version and object counts
mitre_detection_coverage
Analyze detection coverage based on available data sources
mitre_get_campaign
Get campaign details with techniques, software, and groups
mitre_get_datasource
Get data source details with detectable techniques
mitre_get_group
Get group details including techniques and software used
mitre_get_mitigation
Get mitigation details with addressed techniques
mitre_get_software
Get software details with techniques and associated groups
mitre_get_tactic
Get tactic details with all associated techniques
mitre_get_technique
Get full details of a technique by ID (T1059, T1059.001)
mitre_list_campaigns
List all known ATT&CK campaigns
mitre_list_groups
List all known threat groups
mitre_list_tactics
List all tactics in kill-chain order
mitre_map_alert_to_technique
Map security alerts to likely ATT&CK techniques
mitre_map_wazuh_alert
Map Wazuh alerts to ATT&CK techniques by rule ID/description/groups
mitre_misp_create_event
Create events pre-tagged with ATT&CK techniques (write-gated)
mitre_misp_event_to_attack
Map MISP event attributes/galaxies to ATT&CK
mitre_misp_list_events
List events with ATT&CK enrichment
mitre_misp_search_indicators
Search MISP IOCs by technique or group
mitre_mitigations_for_technique
Get all mitigations for a specific technique
mitre_navigator_layer
Generate ATT&CK Navigator JSON layers (coverage, group, campaign, diff)
mitre_search_campaigns
Search campaigns by keyword or technique
mitre_search_groups
Search groups by keyword or technique usage
mitre_search_mitigations
Search mitigations by keyword
mitre_search_software
Search software by name, technique, or type (malware/tool)
mitre_search_techniques
Search techniques by keyword, tactic, platform, data source
mitre_soc_status
Connection status for all SOC integrations
mitre_technique_overlap
Find technique overlap between groups for attribution
mitre_thehive_create_case
Create a case pre-populated with ATT&CK context (write-gated)
mitre_thehive_enrich
Enrich a TheHive case with ATT&CK techniques and mitigations
mitre_thehive_list_cases
List cases with ATT&CK technique filtering
mitre_update_data
Force update of the local ATT&CK data cache
mitre_wazuh_alerts
Fetch recent alerts enriched with ATT&CK context
mitre_wazuh_rule_coverage
Analyze Wazuh rules mapped to ATT&CK techniques
mitre_wazuh_status
Wazuh manager status, agents, and rule stats