About

A living, agent-enriched, multi-dimensional knowledge base of cyber attack types — and the detection lab used to check which of them our defences actually see.

How it is built

• One record per attack. A YAML file is the source of truth; it compiles to SQLite and STIX 2.1.
• Facets, not tags. Each attack is classified across ~24 controlled-vocabulary facets (severity, vector, platform, detectability, …) with a confidence, method and cited source on every assignment.
• Authoritative enrichment. MITRE ATT&CK, ATLAS, CAPEC, CWE, D3FEND, CISA KEV, NVD and EPSS are imported with provenance.
• Measured, not guessed. Benign emulations are detonated in an isolated lab; the SIEM result is graded and fed back as the detectability and noise facets.
• Gated autonomy. Research agents work up to defined human-approval gates.

Where each value comes from

Every facet value on an attack page is colour-coded by how it was set. Hover a value for its source.

• Reviewed checked by a human analyst
• Lab-measured measured by detonating an emulation in the detection lab
• Imported taken from an authoritative framework or feed (ATT&CK, CAPEC, NVD …)
• Derived inferred by a documented rule table from framework links
• Machine-classified classified by a language model; not yet reviewed

When one facet has several candidates the most trusted wins: reviewed, then imported (including lab and derived values), then machine-classified. Detectability is the exception: a lab measurement and the public-content count answer different questions, so attack pages show both.

Right now

657 attacks · 657 enriched · 43 lab-measured · 2 articles · 633 posters · 335 with machine-classified values still awaiting review. Corpus built 2026-11-02.

This site is defensive research material. Lab emulations are benign, connect-only probes run in an air-gapped environment.