Classify security alerts into MITRE ATT&CK technique IDs. Designed as part of the CyberSOC Triage Agent pipeline — not a standalone threat intelligence product.

Training Data

alirezaaminzadeh/soc-alert-attack-dataset — 2,500 labeled alerts (primarily synthetic, mapped from Sigma/Zeek/Suricata patterns)
MITRE ATT&CK STIX enterprise bundle for technique catalog

Evaluation (holdout)

See train_metrics.json for holdout macro/micro F1. Full pipeline metrics in dataset eval_results.json.

Limitations

Trained predominantly on synthetic alerts; real-world SIEM exports may differ
CPU-only inference; no GPU required
Technique coverage limited to labels present in training corpus (~17 base techniques)
Retrieval uses lexical TF-IDF, not neural embeddings

Built by Aria AI.

alirezaaminzadeh/attack-technique-classifier

Attack Technique Classifier

Architecture

Intended Use

Training Data

Evaluation (holdout)

Limitations

alirezaaminzadeh/
attack-technique-classifier