{"id":18719531,"url":"https://github.com/center-for-threat-informed-defense/tram","last_synced_at":"2025-05-15T12:06:05.477Z","repository":{"id":37396162,"uuid":"297733895","full_name":"center-for-threat-informed-defense/tram","owner":"center-for-threat-informed-defense","description":"TRAM is an open-source platform designed to advance research into automating the mapping of cyber threat intelligence reports to MITRE ATT\u0026CK®.","archived":false,"fork":false,"pushed_at":"2025-05-06T13:52:16.000Z","size":53015,"stargazers_count":487,"open_issues_count":45,"forks_count":96,"subscribers_count":76,"default_branch":"main","last_synced_at":"2025-05-06T14:54:38.085Z","etag":null,"topics":["ctid","cyber-threat-intelligence","cybersecurity","mitre-attack","threat-informed-defense"],"latest_commit_sha":null,"homepage":"https://ctid.io/tram","language":"Jupyter Notebook","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/center-for-threat-informed-defense.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-09-22T18:14:50.000Z","updated_at":"2025-05-06T13:37:59.000Z","dependencies_parsed_at":"2024-12-28T20:03:13.948Z","dependency_job_id":"8b1aa479-ec65-47ae-93ef-7b9f614fc05a","html_url":"https://github.com/center-for-threat-informed-defense/tram","commit_stats":null,"previous_names":[],"tags_count":8,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/center-for-threat-informed-defense%2Ftram","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/center-for-threat-informed-defense%2Ftram/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/center-for-threat-informed-defense%2Ftram/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/center-for-threat-informed-defense%2Ftram/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/center-for-threat-informed-defense","download_url":"https://codeload.github.com/center-for-threat-informed-defense/tram/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254337613,"owners_count":22054253,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ctid","cyber-threat-intelligence","cybersecurity","mitre-attack","threat-informed-defense"],"created_at":"2024-11-07T13:26:36.012Z","updated_at":"2025-05-15T12:06:00.465Z","avatar_url":"https://github.com/center-for-threat-informed-defense.png","language":"Jupyter Notebook","funding_links":[],"categories":[],"sub_categories":[],"readme":"# TRAM\n\n[![MITRE ATT\u0026CK® v13](https://img.shields.io/badge/MITRE%20ATT%26CK®-v13-red)](https://attack.mitre.org/versions/v13/)\n![Build](https://img.shields.io/github/actions/workflow/status/center-for-threat-informed-defense/tram/test.yml)\n[![Coverage](https://img.shields.io/codecov/c/github/center-for-threat-informed-defense/tram?token=ejCIZhBRGr)](https://codecov.io/gh/center-for-threat-informed-defense/tram)\n\nThreat Report ATT\u0026CK Mapper (TRAM) is an open-source platform designed to reduce cost\nand increase the effectiveness of integrating ATT\u0026CK  across the CTI community. It does\nthis by automating the mapping of cyber threat intelligence (CTI) reports to MITRE\nATT\u0026CK®. Threat intel providers, threat intel platforms, and analysts can use TRAM to\nintegrate ATT\u0026CK more easily and consistently into their products.\n\nThe platform works out of the box to identify up to 50 common ATT\u0026CK techniques in text\ndocuments; it also supports tailoring the model by annotating additional items and\nrebuilding the model. This Wiki describes the results of the Center for Threat-Informed\nDefense (CTID) research into automated ATT\u0026CK mapping and provides details and\ninstructions for tailoring the platform to your organization's unique dataset.\n\n**Table Of Contents:**\n\n- [Getting Started](#getting-started)\n- [Getting Involved](#getting-involved)\n- [Questions and Feedback](#questions-and-feedback)\n- [How do I contribute?](#how-do-i-contribute)\n- [Notice](#notice)\n\n## Getting Started\n\nThe TRAM web application can be deployed in a containerized environment with Docker or\nKubernetes. You should read the installation instructions to make sure that you are\ncomfortable with the prerequisites. Alternatively, if you want to focus on Machine\nLearning Engineering, you can run the project notebooks for fine tuning your own models.\n\n| Resource                                                                                         | Description                                                                                          |\n| ------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------- |\n| [Documentation](https://github.com/center-for-threat-informed-defense/tram/wiki)                 | Complete documentation for TRAM                                                                      |\n| [Installation](https://github.com/center-for-threat-informed-defense/tram/wiki/Installation)     | Instructions for downloading and installing TRAM container images                                    |\n| [Notebooks](https://github.com/center-for-threat-informed-defense/tram/tree/main/user_notebooks) | Jupyter notebooks for SciBERT-based single-label and multi-label models.                             |\n| [Developer Setup](https://github.com/center-for-threat-informed-defense/tram/wiki/Developers)    | Instructions for contributing code changes to TRAM. Only required for local development and testing. |\n\n## Getting Involved\n\nThere are several ways that you can get involved with this project and help advance\nthreat-informed defense:\n\n- **Install the TRAM web application and try processing CTI reports.** We welcome your\n  feedback on the effectiveness of using machine learning to identify TTPs in\n  human-readable text.\n- **Share your use cases.** We are interested in developing additional tools and\n  resources to help the community understand and make threat-informed decisions in their\n  risk management programs. If you have ideas or suggestions, we consider them as we\n  explore additional research projects.\n- **Label your own data and use the notebooks to fine tune your own models.** This is a\n  complex undertaking, but it allows you to adapt TRAM to your own environment and data.\n  If you have high end GPUs in your environment, you can run these notebooks on your own\n  instrastructure; otherwise you can run them on the paid or free tiers of [Google\n  Colab](https://colab.research.google.com/).\n\n## Questions and Feedback\n\nPlease submit issues for any technical questions/concerns or contact\nctid@mitre.org directly for more general inquiries.\n\nAlso see the guidance for contributors if are you interested in contributing or simply\nreporting issues.\n\n## How do I contribute?\n\nWe welcome your feedback and contributions to help advance TRAM. Please see the\nguidance for contributors if are you interested in [contributing or simply\nreporting issues.](/CONTRIBUTING.md)\n\nTo contribute training data, see [the Data Annotation wiki](https://github.com/center-for-threat-informed-defense/tram/wiki/Data-Annotation).\n\nPlease submit\n[issues](https://github.com/center-for-threat-informed-defense/tram/issues) for\nany technical questions/concerns or contact ctid@mitre.org directly\nfor more general inquiries.\n\n## Notice\n\n©2023 MITRE. Approved for Public Release. Document numbers CT0035, CT0075.\n\nLicensed under the Apache License, Version 2.0 (the \"License\"); you may not use\nthis file except in compliance with the License. You may obtain a copy of the\nLicense at\n\n\u003chttp://www.apache.org/licenses/LICENSE-2.0\u003e\n\nUnless required by applicable law or agreed to in writing, software distributed\nunder the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR\nCONDITIONS OF ANY KIND, either express or implied. See the License for the\nspecific language governing permissions and limitations under the License.\n\nThis project makes use of MITRE ATT\u0026CK®\n\n[ATT\u0026CK Terms of Use](https://attack.mitre.org/resources/terms-of-use/)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcenter-for-threat-informed-defense%2Ftram","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcenter-for-threat-informed-defense%2Ftram","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcenter-for-threat-informed-defense%2Ftram/lists"}