Reports Classification by Adversarial Tactics and Techniques
A python tool to predict Att&ck tactics and techniques from cyber threat reports. ## Usage This tool is designed to predict tactics and techniques from the ATT&CK framework (https://attack.mitre.org/) in cyber threat reports, such as the ones that can be linked in https://otx.alienvault.com/ or https://exchange.xforce.ibmcloud.com/. rcATT is useable either by a command-line interface or a graphical interface. Both versions have the same functionalities:
Example of output STIX file
#### Give feedbacks to the tool by modifying the prediction to positive or negative Use the command line: python app.py -f [list of tactics and techniques] -i [input a result .json file generated by rcATT] -o [output .json file] #### Save the feedbacks and/or the results to the training set Use the command python app.py -a -i [.json file provided by rcATT] #### Retrain the classifier with new data Use the command python app.py -t #### Save results in a json file in a STIX format In the command-line version, this step is included in the prediction or the feedback functionalities by adding an -o [output json file] to the command given. Precise a name and a date using -n [title of the report] and -d [date of publication]. ### Graphical interface #### Predict tactics and techniques from a given cyber threat reports in a text format Enter the report in the text area and click the "predict" button. #### Give feedbacks to the tool by modifying the prediction to positive or negative Click the "Correct the results" button. #### Save the feedbacks and/or the results to the training set Click the "Save the results for training" button. #### Retrain the classifier with new data Click the "⚙" button. #### Save results in a json file in a STIX format Click the "Export the results" button and fill in the form (if not filled in, default values will be given) ## More details Created by Valentine Legoy, during her Master thesis at the University of Twente, in partnership with Siemens. You can find more details on this work in the following paper: "Retrieving ATT&CK tactics and techniques in cyber threat repots".