Search | RSS Feed | Subscribe

• 

  How CTI Butler Creates a Threat Intelligence Graph of Common Frameworks

  product-update March 11, 2024

  CTI Butler links many common knowledge bases, for example linking MITRE ATT&CK to CAPEC objects, to improve the context of our research. This post describes the logic CTI Butler employs behind the scenes to do this.
• 

  CTI Developers: We Built an API for MITRE ATT&CK, CWE, CAPEC, ATLAS... and more!

  announcement February 12, 2024

  Here is a quick-start guide to CTI Butler showing you how much easier it makes working with these frameworks.
• 

  Getting Started with the MITRE ATT&CK Navigator

  tutorial January 15, 2024

  The MITRE ATT&CK Navigator is a very useful tool to explore the MITRE ATT&CK (and other similar frameworks). In this post I take a look what you can do with Navigator and how it works under the hood so that you can use it to model your own ATT&CK-like frameworks.
• 

  How to Build Custom MITRE ATT&CK Content Using Workbench (Step-by-Step Guide)

  tutorial December 11, 2023

  A practical Workbench guide: extend ATT&CK, link objects to techniques, and publish collections other teams and tools can consume.
• 

  STIX Shifter: Turning STIX Patterns into SIEM Queries

  tutorial November 13, 2023

  Learn how to translate STIX detection patterns into SIEM queries using STIX Shifter, and convert detections back into STIX Observed Data for evidence and correlation.
• 

  How to Write STIX Indicator Patterns for Real Detection Rules

  tutorial October 16, 2023

  Learn how to turn threat intelligence into actionable detection rules. Learn how to build behavioral detection using STIX Patterns, and link sightings to evidence.
• 

  STIX Storage for Developers: Memory, Files, and Databases

  tutorial September 18, 2023

  A practical guide to storing and querying STIX 2.1 data using MemoryStore, FileSystemStore, and ArangoDB — with Python examples.
• 

  STIX Extensions in the Wild: How to Add What the Spec Forgot

  tutorial August 14, 2023

  How to design and ship STIX 2.1 extensions — new objects, nested props, and bundles — that your consumers will love.
• 

  Schema Chaos and the Art of STIX Maintenance

  tutorial July 10, 2023

  All I wanted was EPSS and CVSS to show up in OpenCTI. Instead, I ended up reverse-engineering half its schema and building new STIX Extensions from scratch. Here’s the mildly painful but oddly satisfying journey.
• 

  Your First STIX Objects: A Developer’s Guide to STIX 2.1 with Python

  tutorial June 19, 2023

  The fast, code-first way to generate valid STIX 2.1 threat intelligence in Python. Covers SDOs, SCOs, relationships, versioning, and bundling — everything you need to start building and sharing structured intel like a pro.