MITRE: MITRE's Center for Threat-Informed Defense offers TRAM (Threat Report ATT&CK Mapper), an open-source tool that uses machine learning and large language models to automatically identify and classify adversary tactics and techniques in cybersecurity threat intelligence reports. The tool assists security analysts who previously had to map reports manually. | AI Trace
Data AnalysisVerified
MITRE's Center for Threat-Informed Defense offers TRAM (Threat Report ATT&CK Mapper), an open-source tool that uses machine learning and large language models to automatically identify and classify adversary tactics and techniques in cybersecurity threat intelligence reports. The tool assists security analysts who previously had to map reports manually.
Details
TRAM takes prose-based cyber threat intelligence (CTI) reports as input and outputs classifications mapping sentences or phrases to specific MITRE ATT&CK techniques. The latest version uses fine-tunedlarge language models to improve speed and accuracy of technique identification. The platform works out of the box to identify up to 50 common ATT&CK techniques and supports analyst validation of results. TRAM was developed in collaboration with industry partners including CrowdStrike, JPMorgan Chase, and HCA. The tool is freely available on GitHub and is actively maintained.
