CVE2CAPEC is a Python pipeline that enriches every newly published CVE with CWE, CAPEC, MITRE ATT&CK, D3FEND and ATLAS mappings, giving defenders and authorized assessment teams a continuously updated vulnerability-to-technique knowledge base.
| Tool | Galeax/CVE2CAPEC — automated daily pipeline linking CVEs to CWE, CAPEC, MITRE ATT&CK, D3FEND and ATLAS techniques |
| Category | Threat intelligence enrichment / vulnerability-to-TTP mapping, Python + GitHub Actions |
| Primary Use | Mapping newly published CVEs to adversary techniques and defensive countermeasures for prioritization, threat modeling and reporting in authorized engagements |
| Safe Use | Purely analytical correlation of public MITRE/NVD data; intended for defensive research, detection engineering and authorized security assessments with no exploitation capability |
| Telemetry Note | None — a passive data-correlation tool; if self-hosted it issues outbound requests to public MITRE/CWE/CAPEC feeds and leaves only local database files, making its use invisible to targets and irrelevant to defender telemetry |
One of the most persistent friction points in vulnerability management is the gap between a raw CVE identifier and the question security leadership actually asks: what can an adversary do with this, and how do we detect or prevent it? CVE2CAPEC, a Python project by Galeax presented in the BlackHat Europe 2025 Arsenal track, attacks exactly that gap. It takes the daily stream of new CVEs and walks them up the semantic ladder from CWE weakness classes, through CAPEC attack patterns, to MITRE ATT&CK techniques, and then across to the defensive counterpart MITRE D3FEND and the machine-learning-focused MITRE ATLAS matrix. The result is a machine-readable graph that turns a vulnerability feed into a technique-aware intelligence product.
The architectural insight that makes this tool unusually low-maintenance is that it is designed not to be run by the consumer at all. A GitHub Actions job refreshes the databases every day at 00:05 UTC, meaning the enrichment happens upstream and you can simply consume the output in results/new_cves.jsonl. That JSONL file is the practical interface for anyone building automation: each new CVE arrives pre-linked to its CWE, CAPEC, ATT&CK, D3FEND and ATLAS entries, ready to be ingested into a threat intel platform, a SIEM enrichment pipeline, or a reporting script. This push-model design also means the repository itself functions as a continuously published dataset under the GPL-3.0 license, with a commercial licensing option available via the maintainer for organizations that cannot ship GPL-derived data products.
Internally, the pipeline is expressed as a chain of small, single-purpose scripts, each handling one hop in the ontology. retrieve_cve.py pulls the new CVE records; cve2cwe.py resolves each to its weakness classification; cwe2capec.py maps weaknesses onto attack patterns; capec2technique.py lifts those into ATT&CK techniques; technique2defend.py crosses into D3FEND countermeasures; and technique2atlas.py extends the mapping into the ATLAS knowledge base for ML-system threats. Finally build_web_index.py constructs a lightweight CVE-to-CWE index that powers the project's web interface, with a --all flag for a full rebuild when you want the historical corpus rather than just recent years. This modularity is deliberate: each hop is independently debuggable, and the upstream feeds — attack.mitre.org, d3fend.mitre.org, atlas.mitre.org, capec.mitre.org, cwe.mitre.org — can be refreshed independently via the update_capec_db.py, update_cwe_db.py, update_technique_db.py, update_defend_db.py and update_atlas_db.py scripts.
The web front-end deserves attention in its own right. Hosted as a GitHub Pages application at galeax.github.io/CVE2CAPEC, it exposes an interactive generator for ATT&CK, D3FEND and ATLAS technique views — effectively a Navigator-style experience driven by the CVE-to-technique correlations the backend produces. The README's animated demo shows the flow from a list of CVEs to populated technique matrices. For purple-team planning, this is the payoff: paste the CVEs relevant to your estate and get an attacker-side view (ATT&CK) paired directly with a defender-side view (D3FEND), which is a rare and useful symmetry in enrichment tooling.
The source licensing story is handled cleanly. MITRE ATT&CK and ATLAS data arrive under Apache 2.0, D3FEND under MIT, and the embedded Navigator components (mitre-atlas/atlas-navigator, mitre-atlas/atlas-data) are likewise permissively licensed — the README lists all of this explicitly. The project itself ships as GPL-3.0, with a contact address (contact [AT] galeax.com) for alternative commercial terms. Anyone planning to embed the generated database into a commercial product should read that section carefully, because the data files in the database folder inherit the project license even though their upstream sources are permissive.
Where does this fit in an authorized workflow? The most obvious niche is report enrichment: a pentest or red-team deliverable that lists exploited CVEs can be upgraded from a flat finding list into mapped adversary behaviors, which clients' detection engineering teams can act on directly. On the defensive side, the D3FEND linkage is arguably the more novel contribution — most enrichment chains stop at ATT&CK, leaving defenders to manually translate techniques into countermeasures. Here, a CVE observed in telemetry can be traced through to candidate mitigations, shortening the path from vulnerability disclosure to control validation. Vulnerability prioritization teams can also use the CAPEC layer to distinguish CVEs that map to well-understood attack patterns from those with no behavioral mapping at all, a useful triage signal.
Caveats worth flagging to a professional audience: the mappings inherit the quality of the upstream CVE-to-CWE assignments, which are notoriously inconsistent, and the CWE-to-CAPEC and CAPEC-to-ATT&CK relations are many-to-many by nature. That means the tool produces candidate correlations, not authoritative causal claims — a CVE that chains to a dozen techniques tells you about the weakness class's breadth, not that all twelve behaviors are practically reachable. Treat the output as hypothesis-generating input for threat modeling rather than a verdict. The daily 00:05 UTC refresh cadence also implies some lag between NVD publication and enrichment, relevant when working zero-day-adjacent timeframes.
Operational adoption is trivial by design. git clone the repository and pip install -r requirements.txt is the entire local setup for Python 3.11.9, and most users will not even need that — the published results/new_cves.jsonl and the hosted web generator cover the common cases. If you do self-host, running the update scripts against a rate-limited network or an air-gapped environment requires thought, since each hop depends on fetching current copies of the MITRE, CWE and CAPEC corpora. The database folder then becomes your local source of truth and can be versioned or shipped alongside internal tooling.
At roughly 320 stars with active maintenance and a BlackHat Arsenal presentation behind it, CVE2CAPEC sits in that sweet spot of tooling that is mature enough to depend on but small enough to audit in an afternoon. For threat intelligence analysts, detection engineers, and consultants who regularly need to translate vulnerability data into behavioral and defensive frames — and who want that translation automated, versioned, and free — it is one of the more pragmatic bridges between the vulnerability management and threat intelligence disciplines currently published as open source.
Galeax/CVE2CAPEC.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.