<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-threat-landscape-mapping
description: >-
  Map the threat landscape for an organization by correlating sector targeting
  data, geographic threat patterns, technology stack exposure, and active threat
  actor campaigns into a prioritized threat matrix.
domain: cybersecurity
subdomain: threat-intelligence
tags:
  - threat-landscape
  - sector-analysis
  - threat-matrix
  - risk-mapping
  - attack-surface
  - threat-prioritization
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---
# Performing Threat Landscape Mapping

## Overview

Threat landscape mapping produces a comprehensive view of threats relevant to a
specific organization by correlating sector targeting data, geographic threat
patterns, technology stack vulnerabilities, and active adversary campaigns. This
skill covers building threat matrices, mapping attack surface to threat actor
capabilities, and maintaining living threat landscape documents.

## Prerequisites

| Requirement | Details |
|---|---|
| Python 3.10+ with `requests`, `attackcti`, `stix2` libraries | Required |
| MITRE ATT&CK data for group-technique mapping | Required |
| Organization asset inventory and technology stack data | Required |
| Threat intelligence feeds for active campaign data | Required |
| Shodan or Censys for external attack surface data | Required |

## Key Concepts

### Threat Matrix Structure

```
              | Threat Actor 1 | Threat Actor 2 | Threat Actor 3 |
Motivation    | Espionage      | Financial      | Hacktivist     |
Capability    | HIGH           | MEDIUM         | LOW            |
Targeting Fit | HIGH           | HIGH           | LOW            |
Active Campaigns | Yes         | Yes            | No             |
Priority Score| 95             | 78             | 25             |
```

### Attack Surface Mapping

External attack surface elements:
- **Web applications**: technology stack, frameworks, exposed APIs
- **Network services**: open ports, protocols, misconfigurations
- **Cloud assets**: S3 buckets, Azure blobs, misconfigured IAM
- **Email infrastructure**: SPF/DKIM/DMARC configuration
- **Supply chain**: third-party integrations, vendor access

### Sector Targeting Patterns

Map ATT&CK groups by sector targeting:
- Financial: FIN7, FIN8, Carbanak, Lazarus
- Healthcare: APT41, FIN12, various ransomware groups
- Energy: Sandworm, XENOTIME, APT33
- Technology: APT10, APT41, Scattered Spider

## Workflow

### Step 1: Build Sector Threat Profile

```python
from attackcti import attack_client

def get_sector_threat_actors(sector_keywords: list[str]) -> list[dict]:
    """Get threat actors targeting a specific sector."""
    lift = attack_client()
    groups = lift.get_groups()
    relevant = []
    for group in groups:
        desc = (group.get("description", "") or "").lower()
        if any(kw.lower() in desc for kw in sector_keywords):
            refs = group.get("external_references", [{}])
            relevant.append({
                "name": group.get("name", ""),
                "id": refs[0].get("external_id", "") if refs else "",
                "description": (group.get("description", "") or "")[:200],
                "aliases": group.get("aliases", []),
            })
    return relevant
```

### Step 2: Map Attack Surface

```python
import shodan

def map_external_surface(api_key: str, org_query: str) -> dict:
    """Map external attack surface via Shodan."""
    api = shodan.Shodan(api_key)
    results = api.search(org_query)
    services: dict[int, int] = {}
    technologies: list[str] = []
    for match in results.get("matches", []):
        port = match.get("port", 0)
        services[port] = services.get(port, 0) + 1
        if match.get("product"):
            technologies.append(match["product"])
    return {
        "total_hosts": results.get("total", 0),
        "top_ports": dict(sorted(services.items(), key=lambda x: x[1], reverse=True)[:10]),
        "technologies": list(set(technologies))[:20],
    }
```

### Step 3: Build Threat Matrix

```python
def build_threat_matrix(
    actors: list[dict], surface: dict, sector: str
) -> list[dict]:
    """Build prioritized threat matrix."""
    matrix = []
    for actor in actors:
        targeting_fit = "HIGH" if sector.lower() in actor.get("description", "").lower() else "MEDIUM"
        score = 50
        if targeting_fit == "HIGH":
            score += 30
        if any(t in str(surface.get("technologies", [])) for t in ["Apache", "nginx", "IIS"]):
            score += 10
        matrix.append({
            "actor": actor["name"],
            "actor_id": actor.get("id", ""),
            "targeting_fit": targeting_fit,
            "priority_score": min(score, 100),
        })
    return sorted(matrix, key=lambda x: x["priority_score"], reverse=True)
```

## Verification

- [ ] Sector-relevant threat actors identified from ATT&CK data
- [ ] External attack surface mapped with technologies and services
- [ ] Threat matrix built with prioritized actor-to-organization mapping
- [ ] Technology stack exposure correlated with actor capabilities
- [ ] Living threat landscape document produced and versioned
- [ ] Matrix updated on new campaign data or infrastructure changes

## References

- [MITRE ATT&CK Groups](https://attack.mitre.org/groups/)
- [Shodan](https://www.shodan.io/)
- [Censys Search](https://search.censys.io/)
- [ENISA Threat Landscape](https://www.enisa.europa.eu/topics/cyber-threats/threats-and-trends)
- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
