attackgen: A cybersecurity incident response testing tool

by ddos · January 29, 2025

AttackGen

AttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK framework. The tool generates tailored incident response scenarios based on user-selected threat actor groups and your organization’s details.

Features

Generates unique incident response scenarios based on chosen threat actor groups.
Allows you to specify your organisation’s size and industry for a tailored scenario.
Displays a detailed list of techniques used by the selected threat actor group as per the MITRE ATT&CK framework.
Create custom scenarios based on a selection of ATT&CK techniques.
Capture user feedback on the quality of the generated scenarios.
Downloadable scenarios in Markdown format.
? Use either the OpenAI API or Azure OpenAI Service to generate incident response scenarios.
? Select from several models available from the OpenAI API endpoint.
? Available as a Docker container image for easy deployment.
Integrated with LangSmith for powerful debugging, testing, and monitoring of model performance.

Requirements

Recent version of Python.
Python packages: pandas, streamlit, and any other packages necessary for the custom libraries (langchain and mitreattack).
OpenAI API key.
LangChain API key (optional) – see LangSmith Setup section below for further details.
Data files: enterprise-attack.json (MITRE ATT&CK dataset in STIX format) and groups.json.

Installation

Clone the repository:

git clone https://github.com/mrwadams/attackgen.git

Change the directory into the cloned repository:

cd attackgen

Install the required Python packages:

pip install -r requirements.txt

Use

Support Our Threat Intelligence

If you find our technology report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal