ttp-extractor

Name: ttp-extractor
Availability: InStock
Author: chenchunrun

Extract MITRE ATT&CK techniques from security reports and generate Sigma rules.

1|1|Updated Apr 25, 2026

Search Tags:#security-automation #threat-hunting #threat-intelligence #mitre-attack #ttp-extraction #sigma-rules #attack-mapping

Ready to run

npx skills add https://github.com/chenchunrun/onyx-soc --skill ttp-extractor

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ttp-extractor
Source: https://github.com/chenchunrun/onyx-soc/tree/main/skills/ttp-extractor
Command: npx skills add https://github.com/chenchunrun/onyx-soc --skill ttp-extractor

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill helps security teams automatically extract attack techniques, defensive gaps, and MITRE ATT&CK mappings from security reports and threat intelligence, enabling faster threat understanding and response.

Core Features & Use Cases

TTP extraction from reports and intel, with ATT&CK mapping
Sigma rule generation for detections and alerting
Threat hunting queries and defensive recommendations for SOC workflows
Use Case: When provided with a security report, produce ATT&CK-aligned techniques, detection rules, and hunting queries for incident response.

Quick Start

Analyze a security report to extract ATT&CK techniques and generate Sigma rules for detections.

Frequently Asked Questions about ttp-extractor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I extract MITRE ATT&CK techniques from threat intelligence reports?▼

To extract MITRE ATT&CK techniques from threat intelligence reports, you can automatically identify attack techniques within the text and map them directly to the corresponding ATT&CK framework categories. This enables faster threat understanding and incident response.

Can I generate Sigma rules from security reports for SOC workflows?▼

Yes, you can generate Sigma rules from security reports by extracting the identified attack techniques and translating them into detection rules. This process also yields threat hunting queries and defensive recommendations suitable for SOC automation.

What is the best way to map threat hunting queries to MITRE ATT&CK?▼

The best way to map threat hunting queries to MITRE ATT&CK is to analyze security reports to identify attack techniques, map them to ATT&CK, and apply the analysis to generate structured hunting queries. This aligns detections directly with known adversary behaviors.

Does this TTP extraction approach output structured data for security automation pipelines?▼

Yes, this TTP extraction approach exports results in a structured format suitable for ingestion into a security automation pipeline. It packages ATT&CK mappings, Sigma rules, and hunting queries for automated defense workflows.

How do I identify defensive gaps from threat intelligence reports?▼

You identify defensive gaps from threat intelligence reports by automatically extracting attack techniques and mapping them to MITRE ATT&CK. This process highlights uncovered adversary behaviors and generates defensive recommendations for your SOC.