attack-flow diagram

attack-flow-builder.py → export json

Model attack chains with Attack Flow (MITRE), building adversary operation diagrams in JSON.

Use it when you want to model the attack chain of an operation: Attack Flow (from MITRE) defines the format to represent chains — the attack steps (access, execution, movement) with their relationships and assets — and the builder (attack-flow-builder) constructs the diagram exported in JSON. It's the evolution of the kill chain: the full adversary chain modeled in a structured, shareable way. In purple teaming and reporting, Attack Flow documents the validated operation (the chain the exercise replicated) with detail on each step — the case diagram, standard and analyzable.

Don't use it for point analysis: chain modeling requires full operation analysis — for a single technique, Navigator (019) suffices. The Attack Flow format is structured: steps, assets, and relationships are precisely defined — a poorly built model (steps without relationships) adds nothing. And watch out: the ecosystem is young (the format and tools evolve): builder versions change. The model is built from case (or exercise) analysis: without a documented chain, the diagram is speculation. For reporting, the exported JSON is visualized in the Attack Flow viewer.