attack-mappings-explorer
reference corpus · status live · domain SEC (Security and vulnerabilities) · lane A · refresh pinned · tags GLOBAL · MITRE-ATTACK · SECURITY-CONTROLS · COMPLIANCE · MAPPINGS
What an agent uses it for
An agent correlating controls to adversary behavior queries this for CTID mappings of ATT&CK techniques to NIST 800-53, CIS, Azure/AWS/GCP security controls.
curl -fsSLO https://raw.githubusercontent.com/xerj-org/xerj/corpus-hub/tools/xerj-code/hub/attack-mappings-explorer.jsonxerj corpus add --from ./attack-mappings-explorer.jsonxerj corpus index attack-mappings-explorer then xerj code attack-mappings-explorer "your question"Needs the xerj CLI and a local node running; the copy prompt covers both, checks each step, and shows how to stop only the node you started. No shell: the MCP tool xerj_code_search with corpus: "attack-mappings-explorer", once the corpus is indexed on the node.
Sources and pins
| source | pin | licence | size | review note |
|---|---|---|---|---|
| mappings-explorer | a85e55af3c9f | Apache-2.0 | 60.2 MB / 436 files | licence host-verified (ok-spdx): Apache-2.0 |
60.2 MB across 436 files. Added 2026-10-13.
Rights
Apache-2.0. Redistribution permitted with attribution per the licence review. The review block records a human opening each licence file at the pin. Detector output is a hint, never the verdict.
Retrieval spot-check (G7)
Not yet spot-checked. Queries are pre-registered in the registry before grading.