Attack graph notation
How to read and draw attack graphs: conditions and events, AND and OR, uncertainty, enablers, scoring and ATT&CK codes, with examples to open in the builder.
Learn cyber attacks by modelling them
Break a real attack into the conditions it relied on and the steps the attacker took, map each step to MITRE ATT&CK, and see where a defence would have stopped it.
Continue where you left off
Your progress is saved in this browser only, so it won't appear on another computer.
Learn
Take the course
Seven lessons, from reconnaissance to the attacker's objective. Learn each stage of an attack, then model a scenario and get feedback on your graph.
Go to the course BuildBuild an attack graph
Describe an attack in plain statements or draw it on the page. The builder lays it out in a consistent notation, with ATT&CK techniques and mitigations beside each step.
Open the builderAlso on the site
MITRE ATT&CK explorer
Tactics, techniques and mitigations explained with examples, and linked to the attack graphs that use them.
Learn
Start with the attack graph notation guide. More guides are on the way:
- How attack trees and attack graphs differ, and when to use each
- Reading and using MITRE ATT&CK
- Scoring severity and how easily an attack step could have been mitigated
For lecturers
Set tutorial work with the Attack Graph Builder and receive it in one place.
- Create a class and give students its code. They send their graph as text, SVG and PNG.
- Each graph carries an activity log showing how it was built: time spent, what was typed and what was pasted. You can replay it step by step.
- Mark a whole class in one view, with a summary you can export to a spreadsheet.