<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: building-threat-scenario-libraries
description: >-
  Build and manage reusable threat scenario libraries with ATT&CK mapping.
domain: cybersecurity
subdomain: threat-modeling
tags:
  - threat-scenarios
  - scenario-library
  - mitre-attack
  - reusable-templates
  - threat-catalog
  - knowledge-management
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
  - "T1059"
  - "T1078"
  - "T1548"
---

# Building Threat Scenario Libraries

## Overview

Threat scenario libraries provide reusable, version-controlled collections of attack narratives
mapped to MITRE ATT&CK, STRIDE categories, and industry-specific risk contexts. This technique
covers building, indexing, and maintaining scenario catalogs that accelerate threat modeling
across teams and projects.

Mode: `[MODE: ARCHITECT]` — Knowledge management for systematic threat identification.

## Prerequisites

- MITRE ATT&CK framework knowledge
- Existing threat model outputs or historical incident data
- Python 3.10+
- `pyyaml` for scenario serialization: `pip install pyyaml`

## Key Concepts

### Scenario Structure

| Field | Description |
|-------|-------------|
| `id` | Unique scenario identifier (e.g., `TS-WEB-001`) |
| `title` | Short descriptive name |
| `actor` | Threat actor profile (APT, insider, opportunistic) |
| `attack_path` | Ordered TTPs from initial access to objective |
| `target_assets` | Systems and data at risk |
| `impact` | Business and technical consequence |
| `likelihood` | Probability rating with justification |
| `mitre_techniques` | Mapped ATT&CK technique IDs |
| `mitigations` | Controls that reduce risk |

### Library Organization

- **By domain**: web, mobile, cloud, IoT, ICS
- **By actor**: nation-state, cybercrime, insider, hacktivist
- **By objective**: data theft, ransomware, disruption, espionage

## Workflow

### Step 1: Seed Library from ATT&CK

```bash
node scripts/agent.js --action init --query web
node scripts/agent.js --action create --input scenario.json
```

### Step 2: Validate and Search

```bash
node scripts/agent.js --action validate --input library.json
node scripts/agent.js --action search --query T1190 --input library.json
```

### Step 3: Export

```bash
node scripts/agent.js --action report --input library.json --output report.json
```

## Verification

- [ ] Each scenario has a unique ID and complete metadata fields
- [ ] ATT&CK technique mappings validated against current framework version
- [ ] Scenarios reviewed by domain SMEs for accuracy
- [ ] Library indexed by domain, actor, and objective for fast lookup
- [ ] Version control tracks scenario additions and updates
- [ ] Quarterly review schedule established for scenario currency

## References

- [MITRE ATT&CK Framework](https://attack.mitre.org/)
- [OWASP Threat Modeling Playbook](https://owasp.org/www-project-threat-modeling-playbook/)
- [NIST SP 800-154 — Guide to Data-Centric Threat Modeling](https://csrc.nist.gov/publications/detail/sp/800-154/draft)
- [Threat Modeling Manifesto](https://www.threatmodelingmanifesto.org/)
