Attack Flow

Project Summary

Published : Oct 27, 2022

Attack flow is a data model with supporting tooling and examples for describing sequences of adversary behaviors. Attack flows help defenders understand, share, and make threat-informed decisions based on the sequence of actions in a cyber-attack. Flows can be analyzed to identify common patterns in adversary behavior, overlayed on ATT&CK Navigator layers to understand defensive coverage, and create a foundation for intel-driven adversary emulation plans.


Defenders often track adversary behaviors atomically, focusing on one specific action at a time. This makes it harder to understand adversary attacks and to build effective defenses against those attacks.


Create a language, and associated tooling, to describe flows of ATT&CK techniques and combine those flows into patterns of behavior.


Help defenders and leaders understand how adversaries operate and compose atomic techniques into attacks to better understand defensive posture.


funding Research Participants

Non-Profit Research Participants

Leadership Spotlight: 
Collaborative Leadership Driving Innovation


Hear directly from research participants about this project and why it matters. Learn how these leaders are changing the game on the adversary.

Adoption Spotlights: Center R&D in Action

Adoption Spotlights showcase the Center’s R&D in action to help the community adopt threat-informed defense. Learn how these organizations are leveraging Center R&D to change the game on the adversary.

Share This Project

Stay Informed

Stay informed about new releases of R&D projects and other exciting updates from the Center for Threat-Informed Defense.