🚧 Early alpha — building the foundation. See the roadmap →
MITRE
Standard body — creates adversary-focused cybersecurity frameworks. Gold standard for framework versioning.
Key outputs
Section titled “Key outputs”| Framework | Description | Evolution pattern |
|---|---|---|
| ATT&CK | Adversary tactics & techniques (200+) | Biannual, STIX changelogs |
| D3FEND | Defensive countermeasures | Continuous |
| ENGAGE | Cyber denial & deception | Ad-hoc |
| F3 (Fight Fraud Framework) | Fraud adversary tactics & techniques for financial services; reuses some ATT&CK ids. Published through CTID | Changelog in the repository; no release tags |
Funds CTID via MITRE Engenuity.
In Crosswalker
Section titled “In Crosswalker”ATT&CK is the versioning gold standard — STIX 2.1 JSON with revoked-by deprecation chains. The EvolutionPattern: biannual, rare breaking, evolving IDs, structured_complete changelog.
F3 recommends the bundled linked recipe (mitre-f3-technique-linked), with parent links and tactic hub notes; mitre-f3-technique-flat remains available as the previous default. It shares technique ids with ATT&CK, so a vault holding both can contain two notes for one id string; see the 2026-10-27 log.