Repolode
Submit
mrwadams

mrwadams/attackgen

A cybersecurity incident response testing tool that uses LLMs and MITRE ATT&CK/ATLAS to generate tailored tabletop exercise scenarios from threat actor groups.

View on GitHub
Stars
1,257
Forks
169
Open issues
22
Last commit
6 days ago

What is it?

AttackGen generates incident response tabletop scenarios for security teams. You pick a MITRE ATT&CK threat actor group, an ATLAS AI attack case study, or a custom set of techniques, then enter your organisation's size and industry. The tool produces a Markdown scenario tailored to those inputs, along with a list of detection strategies, log sources and mitigations drawn from the MITRE data, and an ATT&CK Navigator layer file.

The project also covers AI-specific threats. An AI Insider Threat page builds exercises in which a frontier AI agent inside the organisation acts as the adversary, shaped by deployment autonomy level, threat category and STRIDE threats. Models are accessed through LiteLLM, so OpenAI, Anthropic, Google, Mistral, Groq and any OpenAI-compatible endpoint such as Ollama or LM Studio can be used. It ships as a Streamlit web app with a Docker image and an MCP server for agentic clients.

Key features

  • 01Generates scenarios from MITRE ATT&CK Enterprise and ICS threat groups or ATLAS AI attack case studies.
  • 02Builds custom scenarios from selected techniques, with templates for common incidents and AI/ML attacks.
  • 03Lists detection strategies, analytics, log sources and mitigations for each scenario's techniques.
  • 04Exports scenarios as Markdown and ATT&CK or ATLAS Navigator layer files.
  • 05Creates AI insider threat tabletop exercises based on frontier AI agent autonomy levels.
  • 06Supports multiple LLM providers through LiteLLM, including local OpenAI-compatible endpoints.

Use cases

  • Running a tabletop exercise for a SOC or incident response team against a specific threat actor.
  • Preparing purple-team exercises that pair attacker steps with the detections a defender should see.
  • Rehearsing response to attacks on AI and ML systems using ATLAS case studies.
  • Exploring how a frontier AI agent inside an organisation could become an insider threat.

Things to know

  • Licensed under GPL-3.0, a copyleft license that requires derivative works to be distributed under the same terms.
  • Generating scenarios requires an API key from a model provider such as OpenAI, Anthropic, Google, Mistral, Groq, or a custom OpenAI-compatible endpoint.

Topics

#cybersecurity#incident-response#mitre-attack#llm#tabletop-exercise#threat-intelligence#purple-team#ai-security#generative-ai#mitre-atlas

FAQ

What is attackgen?
A cybersecurity incident response testing tool that uses LLMs and MITRE ATT&CK/ATLAS to generate tailored tabletop exercise scenarios from threat actor groups. AttackGen generates incident response tabletop scenarios for security teams. You pick a MITRE ATT&CK threat actor group, an ATLAS AI attack case study, or a custom set of techniques, then enter your organisation's size and industry. The tool produces a Markdown scenario tailored to those inputs, along with a list of detection strategies, log sources and mitigations drawn from the MITRE data, and an ATT&CK Navigator layer file.
Is attackgen free to use? What license does it have?
attackgen is open source under the GPL-3.0 license. Check the license terms before using it in commercial products.
Is attackgen still maintained?
Actively maintained. The last commit to attackgen was on Nov 2, 2026.
What can I use attackgen for?
Running a tabletop exercise for a SOC or incident response team against a specific threat actor. Preparing purple-team exercises that pair attacker steps with the detections a defender should see. Rehearsing response to attacks on AI and ML systems using ATLAS case studies. Exploring how a frontier AI agent inside an organisation could become an insider threat.
Where can I get attackgen?
The source code and installation instructions are on GitHub: https://github.com/mrwadams/attackgen

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects