atc-project/atomic-threat-coverage

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1010 stars · 159 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Atomic Threat Coverage is a Python framework that automatically generates actionable security analytics from Detection, Response, Mitigation, and Simulation perspectives based on the MITRE ATT&CK adversary model. It produces Confluence and Markdown knowledge bases linking Sigma detection rules, data needs, logging policies, Atomic Red Team triggers, and response playbooks.

Use cases

• generate a threat detection knowledge base from MITRE ATT&CK
• map Sigma detection rules to ATT&CK techniques
• build incident response playbooks linked to detections
• document logging policies needed for threat detection
• automatically publish security analytics to Confluence
• create threat hunting dashboards and triage visualizations

When to choose

• your security team uses MITRE ATT&CK and wants automated, interconnected detection/response documentation
• you need to link Sigma rules, data collection requirements, and response playbooks in one knowledge base
• you want to automate publishing security analytics to Confluence or Markdown wikis

When to avoid

• you need a SIEM or real-time alerting engine rather than documentation generation
• you want a simple rule repository without knowledge-base generation
• you don't use MITRE ATT&CK-based workflows

Facets

framework · maturity maintenance

security documentation workflow-automation developer-tools security developer-tools documentation python cli cross-platform mitre-attack threat-hunting incident-response threat-intelligence sigma-rules siem detection-rules knowledge-base-generation

Member repositories

For agents

markdown · JSON · MCP: product_card(name="atc-project/atomic-threat-coverage")