cisagov/decider

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

1226 stars · 129 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Decider is a self-hosted web application from CISA that helps network defenders, analysts, and researchers map adversary behaviors to the MITRE ATT&CK framework. It provides a guided question tree, powerful search and filtering, and export to formats like tables and ATT&CK Navigator heatmaps.

Use cases

• map adversary behaviors to MITRE ATT&CK techniques
• find the right ATT&CK tactic or subtechnique for observed activity
• search and filter ATT&CK techniques during threat analysis
• export ATT&CK mappings to Navigator heatmaps
• walk junior analysts through ATT&CK mapping with guided questions

When to choose

• you need to map adversary TTPs to ATT&CK accurately and quickly
• you want a guided question tree instead of browsing the ATT&CK site manually
• you need to export mappings as tables or ATT&CK Navigator layers
• you want a login-less, self-hosted ATT&CK mapping tool

When to avoid

• you only need to browse the official ATT&CK website without guided mapping
• you need automated detection or threat intelligence feeds rather than manual mapping
• you cannot run Docker or a self-hosted web application

Facets

application · maturity active

search-engine self-hosted developer-tools security self-hosted mitre-attack threat-mapping network-defense threat-intelligence docker web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="cisagov/decider")