# MITRE APT Attack Path Analysis

> Pulls your Recorded Future threat map, maps an APT group's MITRE ATT&CK techniques, and cross-references against live Tenable findings to identify which attack path nodes are actively exploitable.

- Type: Skill
- Author: JHall-19
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Source repository: https://github.com/JHall-19/rf-tenable-attack-path-prioritization
- Repo state: not archived
- Last push: 2026-07-22T16:22:18Z
- Stars: 1 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable, Tenable Hexa AI MCP, Recorded Future
- Domains: threat-intelligence, vulnerability-management
- Tags: attack-path, mitre-attack, threat-intelligence, vulnerability-management, apt, recorded-future, adversary-emulation
- Date added: 2026-07-22
- Works with the Tenable Hexa AI MCP server: yes
- Compatible platforms: Claude Code
- Invocation: `/mitre-apt-attack-path`
- Listing page: https://exchange.tenable.com/skills/mitre-apt-attack-path-analysis
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/skills/mitre-apt-attack-path-analysis.md

A Claude Code skill that bridges Recorded Future threat intelligence with Tenable vulnerability data to produce MITRE ATT&CK-grounded attack path analyses. The analyst selects an adversary from their live RF threat map, and the skill maps the actor's confirmed MITRE techniques against active Tenable findings to determine which steps of the attack path are exploitable today.

## What it does

- Pulls the analyst's live Recorded Future threat map and presents ranked adversaries for selection — no actor name required upfront
- Maps the selected APT group's MITRE ATT&CK techniques using RF entity links as the authoritative source
- Cross-references each technique node against live Tenable One findings, labeling each as `ACTIVE`, `PARTIAL`, `NOT DETECTED`, or `NOT APPLICABLE`
- Identifies the critical path — the shortest confirmed-exploitable sequence from initial access to impact
- Produces a formal attack path analysis table, visual node diagram, and recommended Tenable actions per technique
- Supports optional export as `.md` or CSV

## How it works

The skill runs in three phases: first it calls the RF threat map API to surface ranked threat actors and waits for analyst selection; then it retrieves the actor's MitreAttackIdentifier links from RF and fetches Insikt intelligence notes for enrichment; finally it queries Tenable One for each technique to determine live exploitability and assembles the output. All three data sources are required — RF MCP for threat actor intelligence, and Tenable Hexa AI MCP for live vulnerability cross-reference.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/skills/mitre-apt-attack-path-analysis.json. The full index and how to read it: https://exchange.tenable.com/llms.txt