# cisagov/decider

A web application that assists network defenders, analysts, and researchers in the process of mapping adversary behaviors to the MITRE ATT&CK® framework.

Repository: https://github.com/cisagov/decider
Canonical: https://ross.abutalabs.com/products/decider
Language: HTML
License: NOASSERTION
License Family: other
Topics: cybersecurity, ttp
Last push: 2026-02-20T22:24:57+00:00

## Health v2 (maintenance only)
Score: 52/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 68, release rhythm 8, longevity 92
- inputs: {"age_days": 1295, "days_push": 194, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1226, forks 129 (observed 2026-08-28T04:04:03.194357+00:00)

## What it is
Decider is a self-hosted web application from CISA that helps network defenders, analysts, and researchers map adversary behaviors to the MITRE ATT&CK framework. It provides a guided question tree, powerful search and filtering, and export to formats like tables and ATT&CK Navigator heatmaps.

## Use cases
- map adversary behaviors to MITRE ATT&CK techniques
- find the right ATT&CK tactic or subtechnique for observed activity
- search and filter ATT&CK techniques during threat analysis
- export ATT&CK mappings to Navigator heatmaps
- walk junior analysts through ATT&CK mapping with guided questions

## When to choose
- you need to map adversary TTPs to ATT&CK accurately and quickly
- you want a guided question tree instead of browsing the ATT&CK site manually
- you need to export mappings as tables or ATT&CK Navigator layers
- you want a login-less, self-hosted ATT&CK mapping tool

## When to avoid
- you only need to browse the official ATT&CK website without guided mapping
- you need automated detection or threat intelligence feeds rather than manual mapping
- you cannot run Docker or a self-hosted web application

## Facets
- artifact type: application
- maturity: active
- function: search-engine, self-hosted, developer-tools
- domain: security
- platform: self-hosted
- tags: mitre-attack, threat-mapping, network-defense, threat-intelligence, docker, web-server

## Member repositories
- cisagov/decider (main) score 52

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:03.194357+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:15:18.704856+00:00, confidence not recorded.
  - readme: https://github.com/cisagov/decider (fetched 2026-08-28T04:04:03.194357+00:00, sha 83006d5c8148)
- Data as of 2026-08-30T08:39:29.467469+00:00.