mrwadams/attackgen

AttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK framework. The tool generates tailored incident response scenarios based on user-selected threat actor groups and your organisation's details.

AttackGen – AI‑powered cyber‑incident‑response scenario generator

What it is – AttackGen is a web‑app (built with Streamlit) that creates realistic tabletop‑style incident‑response exercises. It combines the MITRE ATT&CK, MITRE ATLAS, and an emerging AI Insider Threat model with large language models (OpenAI, Anthropic, Google, Mistral, Groq, or any OpenAI‑compatible endpoint via LiteLLM). Users pick a threat‑actor group, an ATLAS case study, or an AI‑insider‑threat template, add organisational details (size, industry), and the system produces a full scenario, a detection‑and‑response report, and an ATT&CK Navigator layer.

Core capabilities (as described in the README)

Scenario generation – Tailored narratives for MITRE ATT&CK Enterprise, ATT&CK ICS, and ATLAS threat groups or case studies.
AI Insider‑Threat templates – Scenarios where a frontier AI agent acts as an insider, driven by the Actions Speak Louder Than Tokens model (autonomy level, STRIDE threats, etc.).
Two‑phase output – Base scenario is delivered first; an optional “purple‑team” narrative (defender’s view) streams in as a second model call.
Detection & Response section – Local data join (no LLM) that maps every technique in the scenario to MITRE detection strategies, analytics, log sources and mitigations.
Export options – Markdown report, ATT&CK Navigator layer (.json), and a compact HTML version via the tabletop skill.
Assistant chat – An integrated LLM chat lets users refine the scenario or the detection narrative without leaving the page.
Model‑agnostic backend – All LLM calls go through LiteLLM, so adding a new model is a one‑line config change.
Docker image – Ready‑to‑run container for easy deployment.
LangSmith integration – Optional tracing/monitoring of LLM calls.
Secure credential handling – API keys stored in a .env file.

How to get it running (README‑based steps)

Prerequisites – Python 3.14+, Docker (optional), API keys for the LLM provider(s) you intend to use.

Clone & install

git clone https://github.com/mrwadams/attackgen.git
cd attackgen
pip install -r requirements.txt   # installs Streamlit, LiteLLM, etc.

Configure – Create a .env file with the required keys, e.g.
```
OPENAI_API_KEY=sk-…
ANTHROPIC_API_KEY=…
```
Run locally
```
streamlit run app.py
```
The UI will appear in your browser.

Docker alternative

docker build -t attackgen .
docker run -p 8501:8501 --env-file .env attackgen

Optional LangSmith – Follow the “LangSmith Setup” section to add LANGCHAIN_API_KEY and enable tracing.
MCP server – For agentic clients, start the FastMCP server with:
```
python -m mcp_server
```
This exposes data‑tool and generate‑tool endpoints that can be called from other LangChain agents.

Typical workflow (user perspective)

Setup sidebar – Choose LLM provider/model, organisation size/industry, and whether you want the purple‑team narrative.
Select a source – Pick a MITRE ATT&CK threat group, an ATLAS case study, or an AI‑insider‑threat template.
Generate – Click Generate; the UI shows progress phases (input prep → base scenario → exports → optional narrative).
Review – The result page displays the Markdown scenario, a compact summary with navigation shortcuts, and a detection & response section.
Refine – Open the “AttackGen Assistant” chat to ask for edits, additional details, or to tweak the defender narrative.
Export – Download the scenario, the ATT&CK Navigator layer, and the detection report for use in tabletop exercises.

Recent highlights (v0.16)

Base‑scenario‑first generation – Users get a usable scenario instantly; the optional defender narrative streams later.
Guided, resilient workflow – The UI disables the Generate button until all required inputs are present and shows a concise pre‑run summary.
Neutral selectors – Threat‑group and case‑study dropdowns only list options that can actually produce a scenario, preventing dead‑ends.
Security hardening – CI now fails on pip‑audit, Bandit, and Trivy findings; Docker base image upgraded to python:3.14‑slim.

License & contribution

The project is released under the MIT License.
Contributions are welcomed; see the Contributing section for guidelines.

Bottom line – AttackGen is a genuine, actively maintained open‑source tool that leverages modern LLM APIs to automate the creation of rich, MITRE‑aligned cyber‑incident‑response scenarios, including novel AI‑insider‑threat exercises. It is squarely in the AI‑augmented cybersecurity space.