MITRE ATT&CK — mapping discipline + technique reference

This skill encodes the discipline of mapping adversary behaviour to ATT&CK and back, plus a locally searchable technique index. Every OpenTide object type carries ATT&CK references; getting them right is a quality gate.

Current baseline: ATT&CK v19 (April 2026, Enterprise domain: 15 tactics, 222 techniques, 475 sub-techniques).

v19 breaking change: Defense Evasion was split into Stealth (TA0005) and Defense Impairment (TA0112). Any existing mappings referencing TA0005 as "Defense Evasion" must be reviewed and re-assigned.

Online version check: If this skill may be outdated, verify the current ATT&CK version at:

Release notes: https://attack.mitre.org/resources/updates/

Version history: https://attack.mitre.org/versions/

Machine-readable STIX: https://github.com/mitre/cti (enterprise-attack branch)

Blog announcements: https://medium.com/mitre-attack

mitre-attack

MITRE ATT&CK — mapping discipline + technique reference

1. Tactic, technique, sub-technique — when to use which