MITRE ATT&CK Techniques Scraper

MITRE ATT&CK Techniques Scraper

Scrape MITRE ATT&CK techniques from any matrix, up to a million per run. Every technique comes with its ID, name, description, tactics, platforms, and detection tips. No login or API key. Export to CSV, JSON, Excel, or XML.

MITRE ATT&CK is the industry standard for adversary tactics and techniques, but its web interface is hard to query at scale. This Actor reads the public ATT&CK matrices directly and returns each technique as a flat row with its full metadata. Filter by matrix type and limit the number of results.

Who uses it	What they scrape MITRE ATT&CK for
Security analysts	Build a local database of ATT&CK techniques for threat hunting
Threat intelligence teams	Map observed adversary behavior to ATT&CK technique IDs
SOC engineers	Feed technique metadata into SIEM detection rules
Red teamers	Generate a checklist of techniques for adversary emulation

What it does

This Actor collects MITRE ATT&CK techniques from the Enterprise, Mobile, or ICS matrix and returns each one as a flat row with its ID, name, description, tactics, platforms, and detection guidance.

• 📋 Matrix selection: choose Enterprise, Mobile, or ICS to scrape the relevant technique set.
• 🔢 Result limit: set a maximum number of techniques to return, from 1 up to 1,000,000.
• 📄 Flat output: each technique is returned as a single row with all fields, ready for export.

Results export to CSV, JSON, Excel, or XML, or straight from the API.

What you can do with MITRE ATT&CK data

🔍 Build a threat hunting knowledge base.

A security analyst scrapes all Enterprise techniques to create a searchable local database for mapping alerts to ATT&CK IDs.

📊 Analyze technique coverage.

A SOC engineer scrapes the ICS matrix to identify which techniques are covered by existing detection rules and which gaps remain.

🧪 Prepare red team exercises.

A red teamer scrapes the Mobile matrix to generate a checklist of techniques for testing mobile device defenses.

📚 Feed threat intelligence platforms.

A threat intel analyst scrapes all matrices and imports the data into a TIP to enrich indicators with technique context.

Why choose this scraper

	What you get
No API key required	Scrape directly from the public ATT&CK website without registration or authentication.
Up-to-date data	Get the latest technique definitions as soon as MITRE updates the matrices.
Structured output	Each technique is returned as a flat row with consistent fields for easy analysis.
Scalable	Fetch up to a million techniques per run for large-scale research.

How it compares

No other Store actor targets MITRE ATT&CK the same way, so the honest comparison is with the alternatives teams actually weigh.

	MITRE ATT&CK Techniques Scraper	Build it in-house	By hand
Setup	Run it now, zero config	Days of engineering	None, but hours per pull
When MITRE ATT&CK changes	Maintained for you	You fix it	You re-learn the page
Proxies, retries, anti-bot	Built in	Your problem	Browser only
Output	Fixed JSON schema, CSV/Excel export	Whatever you build	Copy-paste
Cost	Pay per result	Engineering time	Analyst hours

Configure the run

Drive the Actor by selecting an ATT&CK matrix and a maximum number of techniques. The scraper reads the public matrix pages and returns each technique as a flat row. The Input tab lists every parameter.

A first run with the defaults:

{
  "maxItems": 10
}

A larger pull:

{
  "maxItems": 200
}

Pricing

Pay-per-result: $0.021 per result collected. You pay only for the results written to your dataset.

Results collected	Approximate cost
100 results	$2.10
1,000 results	$21.00
10,000 results	$210.00

New Apify accounts start with $5 in free credit.

Free users

Free-plan runs return up to 10 results as a preview. Upgrade your Apify plan to collect up to 1,000,000 results per run.

Run it

1. Create a free Apify account with $5 in credit.
2. Open the MITRE ATT&CK Techniques Scraper.
3. Set your inputs and any filters, then click Start.
4. Export the results as CSV, Excel, JSON, or XML from the Dataset tab.

Run it programmatically through the Apify API (run-sync-get-dataset-items) or the ApifyClient for JavaScript and Python.

Use with AI agents (MCP)

Give an AI agent live access to MITRE ATT&CK through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:

claude mcp add --transport http apify "https://mcp.apify.com?tools=parseforge/mitre-attack-techniques-scraper"

Then prompt it in plain language to run the scraper and read back the results.

Troubleshooting

Why am I getting no results?

Check that you selected a valid matrix and set maxItems to at least 1. Also ensure the ATT&CK website is reachable from your network.

Why is the run limited to 10 items?

Free accounts are limited to 10 items as a preview. Upgrade to a paid plan to increase the limit up to 1,000,000.

The run fails with a timeout error.

The ATT&CK website may be slow. Try reducing maxItems or retry the run later.

Some fields are empty in the output.

Not all techniques have every field populated. Empty fields are normal for techniques that lack certain metadata.

FAQ

Question	Answer
What is MITRE ATT&CK?	MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It is used by security teams to understand and defend against threats.
Which matrices can I scrape?	You can scrape the Enterprise, Mobile, or ICS matrix by selecting the corresponding option in the input.
Do I need an API key or login?	No. The Actor reads the public ATT&CK web pages directly, so no authentication is required.
What data does each technique include?	Each technique row includes its ID, name, description, tactics, platforms, and detection guidance, among other fields.
How many techniques can I scrape in one run?	Free users are limited to 10 techniques as a preview. Paid users can set a maximum up to 1,000,000.
Can I filter by tactic or platform?	The current input only allows selecting the matrix and maximum items. Filtering by tactic or platform is not yet supported.
How often is the data updated?	The Actor scrapes live data from the ATT&CK website, so it reflects the latest updates whenever you run it.
What output formats are supported?	You can export the results to CSV, JSON, Excel, or XML from the Apify platform.

Related actors

Browse the full ParseForge collection for more scrapers.

🆘 Need help? Email parseforge@protonmail.com with your run ID, your input, and what you expected.

⚠️ Disclaimer. This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by The MITRE Corporation. It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.