TTP Mapper
Paste T-codes from your engagement. Get a ranked list of threat actors by overlap confidence — in under a second.
The Problem It Solves
Attribution takes hours.
TTP Mapper takes seconds.
During an active incident, you've identified the techniques the adversary is using. Leadership wants to know who. Manually cross-referencing T-codes against ATT&CK threat actor profiles takes hours of analyst time — if it gets done at all.
TTP Mapper automates that correlation. Paste your T-codes, run correlation, and get a ranked list of matching threat actors — scored by overlap confidence so you can brief a hypothesis immediately.
Sample Output
What you get back.
Each correlation run returns a ranked list of threat actors — not just names, but nation-state attribution, sponsoring intelligence agency, known campaigns, and a breakdown of which exact techniques matched and which didn't.
The JSON export includes full ATT&CK metadata so you can pipe results directly into your case management platform, SIEM, or brief deck.
- Actor name, nation, and sponsoring agency
- Confidence score + matched/total TTP count
- Known campaigns and historical activity
- Per-technique match breakdown
- Unmatched techniques listed separately
Under the Hood
What's powering
the correlation.
Not a fuzzy keyword search. A structured overlap engine operating on the full ATT&CK corpus — techniques, sub-techniques, actor profiles, and campaign history.
Threat actors, software groups, and malware families from the full MITRE ATT&CK enterprise dataset.
Both top-level techniques (T1078) and sub-techniques (T1566.001) are fully supported and independently weighted.
Overlap percentage calculated per actor — not binary match/no-match. You see gradations, not just a hit list.
Correlation database tracks MITRE ATT&CK releases. New actors and technique mappings are incorporated automatically.
Full structured export: actor profiles, technique breakdowns, confidence scores, unmatched techniques, and metadata.
Pipe T-codes in programmatically from your SIEM, SOAR, or IR platform. Results returned as structured JSON.
Editions
Free for analysts.
Powerful for teams.
Community is open, no account needed. Pro adds team infrastructure, API access, and private intelligence integration.
Know who you're
dealing with.
The community edition is free and requires no account. Start mapping T-codes now, or contact us about Pro for your team.