attack-chain-outliner

Generate structured attack chain documentation with MITRE ATT&CK mappings.

4|Updated Jan 21, 2026

Search Tags:#templates #documentation #threat-modeling #mitre-attack #attack-chain #detection-logic

Ready to run

npx skills add https://github.com/audibleblink/skills --skill attack-chain-outliner

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: attack-chain-outliner
Source: https://github.com/audibleblink/skills/tree/main/attack-chain-outliner
Command: npx skills add https://github.com/audibleblink/skills --skill attack-chain-outliner

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill enables analysts to produce standardized, MITRE-aligned attack chain documentation with clearly defined structure, detection logic, and threat reports, saving time and improving consistency across reports.

Core Features & Use Cases

8-section attack chain template including MITRE mapping, detection opportunities, data sources, and pseudocode queries.
Reusable, template-driven approach for rapid generation of technique-specific documentation and professional reports.
Use cases include documenting adversary techniques, drafting detections, analyzing malware/APT TTPs, and producing threat intelligence summaries.

Quick Start

Draft a complete attack chain document for a technique by selecting the phase, technique name, and output format.

Frequently Asked Questions about attack-chain-outliner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I document MITRE ATT&CK mappings for adversary techniques?▼

Document MITRE ATT&CK mappings by using a structured 8-section template that includes technique mapping, detection opportunities, data sources, and pseudocode queries. This standardized approach ensures consistency across adversary technique, malware, and APT TTP analysis reports.

What is the best way to write detection logic for threat intelligence reports?▼

Writing detection logic for threat intelligence reports is streamlined by generating documents with dedicated sections for data sources and pseudocode queries. This template-driven approach produces Markdown or Typst output aligned with MITRE mappings for rapid detection drafting.

Can I generate attack chain documentation for macOS, Windows, and Linux threats?▼

Yes, you can generate attack chain documentation for macOS, Windows, and Linux threats. The template accommodates cross-platform adversary techniques and requires a frontmatter-based entry with a name and description to initialize the threat report.

How do I create a structured threat intelligence report from scratch?▼

Create a structured threat intelligence report by starting with a frontmatter entry containing a name and description, then populating an 8-section template. This includes mapping MITRE techniques, adding detection logic, and attaching optional resources like scripts or references.

Does this attack chain documentation approach support Markdown and Typst output?▼

Yes, the attack chain documentation supports both Markdown and Typst output formats. You can select your desired output format when drafting the complete document for a specific phase, technique name, and associated resources.

What should I include in an APT TTP analysis document?▼

An APT TTP analysis document should include MITRE ATT&CK mappings, detection opportunities, data sources, and pseudocode queries within an 8-section structure. Optional resources such as scripts, references, and assets can be attached to support the malware analysis.