TRAM: How MITRE Built a SciBERT-Powered Engine to Auto-Map Threat Intel to ATT&CK

Hook

Security analysts manually tagging threat intelligence reports with ATT&CK techniques face tedious, time-consuming work that varies in consistency across teams. MITRE’s Center for Threat-Informed Defense built TRAM to automate this with machine learning, though it requires significant setup and customization to work effectively.

Context

The MITRE ATT&CK framework has become the standard for describing adversary tactics, techniques, and procedures (TTPs). Threat intelligence providers, security vendors, and SOC analysts all speak ATT&CK when discussing how attackers operate. However, manually mapping raw threat reports to ATT&CK techniques is time-consuming and can be inconsistent. TRAM (Threat Report ATT&CK Mapper) emerged from MITRE’s Center for Threat-Informed Defense research into whether natural language processing could standardize and accelerate this mapping process. According to the project description, TRAM is designed to ‘reduce cost and increase the effectiveness of integrating ATT&CK across the CTI community’ by automating the mapping of cyber threat intelligence reports to MITRE ATT&CK. The goal is to help threat intel providers, platforms, and analysts integrate ATT&CK more easily and consistently into their products.

Technical Insight

TRAM’s architecture is built on SciBERT-based models for ATT&CK technique identification. The platform ships with two pre-trained models: a single-label classifier that predicts the most likely ATT&CK technique for a given text snippet, and a multi-label classifier that can identify multiple techniques in a single passage. Both models work out of the box to identify up to 50 common ATT&CK techniques in text documents, as stated in the README.

The platform supports MITRE ATT&CK v13 according to the repository badges. Deployment happens via containerized environments with Docker or Kubernetes support. Once running, analysts can upload threat reports and TRAM returns predicted ATT&CK technique mappings that analysts can review.

For teams needing customization, TRAM includes Jupyter notebooks for fine-tuning models on custom datasets. The repository provides notebooks under user_notebooks/ that demonstrate training pipelines for both single-label and multi-label models. The README explicitly states that fine-tuning can be done on local infrastructure with high-end GPUs or on Google Colab’s paid or free tiers. The annotation workflow requires manually labeling sentences from threat reports with ATT&CK technique IDs, creating labeled training data for model fine-tuning through supervised learning.

What makes TRAM valuable is MITRE’s domain expertise in selecting appropriate models and the operational packaging as a working platform. The organization that created ATT&CK itself has provided a starting point that includes model selection, training data for 50 techniques, and structured workflows. The multi-label classification capability allows the platform to identify multiple techniques in passages that describe complex attack chains, rather than forcing selection of a single technique.

Gotcha

The 50-technique limitation means coverage is restricted compared to the full ATT&CK framework. ATT&CK v13 contains many more techniques and sub-techniques across the Enterprise matrix. If your threat intelligence focuses on specialized attack types, the default models may miss critical mappings. Retraining requires manual annotation of training data, access to GPU compute, and ML expertise.

The effectiveness of default models versus custom-trained models can vary significantly based on your specific use case. The README notes that the platform ‘works out of the box’ for the 50 common techniques but emphasizes the ability to tailor models by ‘annotating additional items and rebuilding the model.’ Organizations should expect to invest in custom training to achieve optimal results for their specific threat intelligence corpus.

Infrastructure requirements involve containerized deployment with Docker or Kubernetes. The README directs users to read installation instructions to ensure comfort with prerequisites, suggesting there’s operational complexity involved. Organizations without existing container infrastructure will need to build that capability. The README also notes that ‘this is a complex undertaking’ when describing the process of labeling data and fine-tuning custom models.

The README doesn’t specify detailed performance metrics, scaling characteristics, or integration capabilities, so organizations should plan to test TRAM thoroughly with their own data and infrastructure before committing to production deployment.

Verdict

Use TRAM if you’re a threat intelligence team, MSSP, or large SOC processing significant volumes of threat reports and seeking to standardize ATT&CK tagging. It’s particularly valuable if you have ML engineering resources to fine-tune models on your specific threat intelligence corpus, as the README emphasizes the platform’s support for customization. The MITRE backing ensures alignment with ATT&CK framework updates, and the Jupyter notebooks provide a foundation for experimentation. The platform is appropriate for organizations comfortable with containerized deployments and willing to invest in the annotation and training workflow to extend beyond the default 50 techniques. Consider carefully whether your infrastructure capabilities, report volumes, and need for technique coverage beyond the default 50 justify the setup and customization investment. Organizations should also evaluate the platform against their own threat intelligence data to assess baseline model performance before committing to production deployment.