ATT&CK technique library
Live sourceTechniques, tactics, platforms, descriptions, and links are retrieved from MITRE's official Enterprise STIX dataset. Stale or unavailable source data is not replaced by a fabricated catalogue.
Adversary emulation / purple team
Test the control path—only inside an approved scope.
ELITZE combines an official MITRE ATT&CK technique catalogue with explicit rules of engagement and the existing signed security-runner boundary. ATT&CK plans provide technique context; they are not represented as executed emulation until a compatible, authorised executor reports a verified result.
Control plane
Built for evidence-first security operations
Unavailable integrations are labeled not configured. Missing evidence is described as not verified or not measurable.
Rules of engagement
RequiredEvery execution request requires an HTTPS target, an allowlisted scope/profile, an authorization reference, and a future expiry time. The runner independently enforces target allowlists, safe DNS resolution, port rules, and signed callbacks.
Nuclei validation boundary
Capability boundaryThe existing runner executes its configured scanner profile. Selecting an ATT&CK technique creates a plan/reference—not proof that a technique was emulated. Technique-specific emulators require a compatible authorised executor.
Purple-team evidence
Evidence lifecyclePreserve timestamps, result hashes, scanner findings, technique references, policy decisions, and retest outcomes. A successful scan process does not itself prove every remediation worked.
Approval-aware automation
Fail closedScheduled runs require explicit valid scope and unexpired authorization. Unconfigured runner state remains RUNNER_NOT_CONFIGURED and never becomes a synthetic success.
AttackIQ compatibility
No invented connectorThe design follows public adversary-emulation principles and ATT&CK mapping. No undocumented AttackIQ API or vendor credential is assumed; a direct platform integration remains NOT_CONFIGURED until its supported contract is supplied.
Related capabilities
Adversary emulation workspaceChoose official techniques and create an explicitly authorised validation request.Runtime securityReview authorized observations, response state and evidence.Threat detectionCorrelate resulting observations without manufacturing coverage.Read the security disclosureReview responsible testing and disclosure boundaries.
ELITZE does not claim a clean posture when telemetry is absent. Live source records, authorization scope, execution state, and verification evidence remain separately visible.