skills.rest
audibleblink
audibleblinkCOMMUNITY
Explore all skills by this author →
Website𝕏@4lexGitHub

attack-chain-outliner

Generate structured attack chain documentation with MITRE ATT&CK mappings.

4|Updated Jan 21, 2026
Search Tags:#templates#documentation#threat-modeling#mitre-attack#attack-chain#detection-logic
One-click install
npx skills add https://github.com/audibleblink/skills --skill attack-chain-outliner
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: attack-chain-outliner
Source: https://github.com/audibleblink/skills/tree/main/attack-chain-outliner
Command: npx skills add https://github.com/audibleblink/skills --skill attack-chain-outliner

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill enables analysts to produce standardized, MITRE-aligned attack chain documentation with clearly defined structure, detection logic, and threat reports, saving time and improving consistency across reports.

Core Features & Use Cases

  • 8-section attack chain template including MITRE mapping, detection opportunities, data sources, and pseudocode queries.
  • Reusable, template-driven approach for rapid generation of technique-specific documentation and professional reports.
  • Use cases include documenting adversary techniques, drafting detections, analyzing malware/APT TTPs, and producing threat intelligence summaries.

Quick Start

Draft a complete attack chain document for a technique by selecting the phase, technique name, and output format.

Frequently Asked Questions about attack-chain-outliner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I document MITRE ATT&CK mappings for adversary techniques?▼

Document MITRE ATT&CK mappings by using a structured 8-section template that includes technique mapping, detection opportunities, data sources, and pseudocode queries. This standardized approach ensures consistency across adversary technique, malware, and APT TTP analysis reports.

What is the best way to write detection logic for threat intelligence reports?▼

Writing detection logic for threat intelligence reports is streamlined by generating documents with dedicated sections for data sources and pseudocode queries. This template-driven approach produces Markdown or Typst output aligned with MITRE mappings for rapid detection drafting.

Can I generate attack chain documentation for macOS, Windows, and Linux threats?▼

Yes, you can generate attack chain documentation for macOS, Windows, and Linux threats. The template accommodates cross-platform adversary techniques and requires a frontmatter-based entry with a name and description to initialize the threat report.

How do I create a structured threat intelligence report from scratch?▼

Create a structured threat intelligence report by starting with a frontmatter entry containing a name and description, then populating an 8-section template. This includes mapping MITRE techniques, adding detection logic, and attaching optional resources like scripts or references.

Does this attack chain documentation approach support Markdown and Typst output?▼

Yes, the attack chain documentation supports both Markdown and Typst output formats. You can select your desired output format when drafting the complete document for a specific phase, technique name, and associated resources.

What should I include in an APT TTP analysis document?▼

An APT TTP analysis document should include MITRE ATT&CK mappings, detection opportunities, data sources, and pseudocode queries within an 8-section structure. Optional resources such as scripts, references, and assets can be attached to support the malware analysis.

Related Skills

Explore More Content & Communication Skills→
OpenTideHQOpenTideHQ
4

mitre-attack

Map OpenTide object signals to MITRE ATT&CK techniques with a local index.

Official
Advanced
MHaggisMHaggis
471

detection-test-engineer

Generate and execute security detection test scenarios across SIEM platforms.

Community
Advanced
aviskaaraviskaar
6

threat-hunter

Conduct proactive threat hunting campaigns using MITRE ATT&CK frameworks.

Official
Advanced
coreymaypraycoreymaypray
1

threat-intel-analyst

Profile threat actors and produce intelligence with MITRE ATT&CK mappings.

Community
Advanced