mitre-attack/car resource

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1022 stars · 359 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

The MITRE Cyber Analytics Repository (CAR) is a knowledge base of detection analytics based on the MITRE ATT&CK adversary model. Each analytic includes a hypothesis, pseudocode, implementation references for tools like Splunk and EQL, and unit tests to trigger detections.

Use cases

• find detection analytics mapped to ATT&CK techniques
• implement adversary behavior detections in Splunk or EQL
• build threat hunting programs based on TTPs
• validate detection coverage against ATT&CK tactics and techniques
• get unit tests to trigger and verify analytics
• start a detection engineering program from community-validated content

When to choose

• you need well-documented, validated detection analytics mapped to ATT&CK
• you want pseudocode and rationale for how detections work
• you are building or improving a threat detection or hunting capability
• you need unit tests to verify your detections fire

When to avoid

• you need a turnkey SIEM or production detection product
• you require analytics for a tool not covered by CAR implementations
• you want exhaustive coverage of all ATT&CK techniques rather than a curated set

Facets

dataset · maturity active

security monitoring developer-tools security cross-platform mitre-attack detection-analytics threat-hunting knowledge-base splunk eql threat-detection

Member repositories

For agents

markdown · JSON · MCP: product_card(name="mitre-attack/car")