AttackGen: LLM-Generated Tabletop Scenarios Built on MITRE ATT&CK and ATLAS

The gap AttackGen fills between threat intelligence and a runnable exercise

Threat intelligence feeds tell you that a group exists and roughly what it does. They do not produce a document a facilitator can hand to a room. Writing that document by hand means pulling technique IDs, inventing a plausible sequence of events, and adding discussion questions, success criteria and rules of engagement. AttackGen automates the drafting step. You pick a threat actor group from the MITRE ATT&CK Enterprise, ICS or ATLAS frameworks, or an AI attack case study, add your organisation's size and industry, and the tool produces a scenario written around that group's techniques. The audience is the purple team or incident response lead who already runs tabletop exercises and wants the first draft faster, not someone looking for an automated adversary emulation platform. The README also describes a distinct mode: AI insider threat scenarios, where a frontier AI agent deployed inside the organisation behaves as an insider threat, shaped by deployment archetype, threat category and STRIDE threats. That mode is unusual enough to be the reason some teams will look at this repository at all.

Phased generation and the frozen input snapshot

The v0.16 release notes describe a generation pipeline that runs in phases rather than one blocking call. The base scenario renders first, and the Download Scenario and Download ATT&CK Navigator Layer buttons become live at that point. An optional purple-team narrative then streams in afterwards. The stated reason is that a slow second pass should not withhold a usable scenario. The release notes also say each run works from a snapshot of the inputs taken when you press Generate, so sidebar changes mid-run cannot half-rewrite the scenario in flight. Progress is reported as named phases (preparing inputs, generating the base scenario, building the deterministic exports, generating the purple-team narrative) alongside a running elapsed-time label. That naming is a small thing, but it tells you the authors have watched a long run and decided the user deserves to know which stage is slow. The deterministic exports are separated from the model calls in the phase list, which suggests the Navigator layer is assembled from the selected techniques rather than generated as free text.

Provider routing through LiteLLM and what it costs you

All model providers go through LiteLLM behind a single internal wrapper. The README lists OpenAI, Anthropic, Google AI, Mistral and Groq, plus any custom OpenAI-compatible endpoint such as Ollama, LM Studio, Azure OpenAI or OpenRouter. The stated benefit is that adding a new model is a one-line change. In practice this means your scenario quality is a function of whichever model you point it at, and the project makes no claim about which one produces better exercises. A local Ollama or LM Studio endpoint keeps the organisation profile and threat group selection on your own hardware, which matters if the industry and company size fields are sensitive. A hosted provider sends them out. The tool also supports optional LangSmith integration for debugging and monitoring model performance. Credentials live in a .env file, and the release notes say API keys are deliberately kept out of the URL query string even though other non-secret selections are mirrored to the URL.

Installation, the readiness gate, and the setup sidebar

The README documents installation, a LangSmith setup step, a data setup step and running instructions, and it ships a Docker container image. The repository is Python with a Streamlit interface, so the practical path for most teams is the container image rather than a local virtualenv. Once running, the interface has changed shape in recent releases. Provider, model, framework, industry and company size now live in a single shared Setup sidebar on every scenario page (Threat Group, Custom and AI Insider Threat) instead of being re-entered per page. Non-secret selections persist across navigation and are mirrored to the URL. Every page lists outstanding requirements in one readiness summary and keeps Generate disabled until nothing is missing. The release notes describe the ordering as the page's own selection first, then any incomplete Setup field. A one-line summary of framework, organisation profile, selection and modifiers appears before generation starts, and the AI-enhanced adversary and purple-team toggles sit above Generate, with the purple-team option stating that it makes a second model call. That last detail is the honest version of a cost warning.

Session persistence, empty states, and the selectors that only offer real options

Each scenario page keeps its own latest result, the inputs that produced it, and its download names for the session. Opening the Assistant and returning leaves the scenario, its Navigator layer and its Detection and Response report in place. Editing the form does not discard the result; it stays with a note that selections have moved on, and only Regenerate or Clear result replaces or removes it. Long scenarios get a compact summary and section index above the full Markdown, with shortcuts to injects, discussion questions, success criteria, metrics, artefacts and rules of engagement. The Assistant is a chat interface for updating or questioning a generated scenario, and it links back to the page that produced it. The release notes also mention two selector fixes: threat-group and case-study selectors now offer only choices that actually produce a scenario, and groups sort in natural numeric order so APT3 comes before APT28 and APT30. Both are the kind of defect that only shows up after real use.

Where AttackGen is the wrong tool

This is a scenario drafting tool, not a validation tool. Nothing in the material suggests it executes techniques, checks whether your detections would fire, or measures coverage. If your requirement is an adversary emulation plan you can run against production, AttackGen produces the narrative around the exercise, not the exercise. The second constraint is data flow. Generating a scenario means sending a threat group selection and an organisation profile to a model provider, and the only way to avoid that is a local OpenAI-compatible endpoint. Third, the output is model-written prose about an adversary. The README offers a feedback capture feature on scenario quality, which implies the authors know output varies, but there is no claim of factual verification against ATT&CK. Treat every technique attribution in a generated scenario as something to check against the framework before it reaches a facilitator. Finally, the release cadence visible in the repository is roughly one minor version every two to three weeks, which is a maintenance signal: expect to update, and expect interface details to move.

How it differs from running the exercise straight out of ATT&CK

The obvious comparison is building the same exercise directly from the MITRE ATT&CK knowledge base and the ATT&CK Navigator. That approach gives you authoritative technique definitions and a layer you control, but it gives you no prose. You still write the injects, the discussion questions, the success criteria and the rules of engagement yourself, and that writing is most of the facilitator's preparation time. AttackGen's trade is the reverse: model-generated prose that needs checking, plus deterministic exports that save the manual layer-building step. The release notes describe the base scenario rendering with its Download Scenario and Download ATT&CK Navigator Layer buttons already live, so the layer is treated as an output of the selection rather than something you assemble. If your team already has a scenario library and a Navigator workflow, the marginal value here is the drafting speed and the AI insider threat mode, not the framework data.

Licence, maintenance cost, and what to check before you commit

AttackGen is GPL-3.0. If you fork it and distribute a modified version, the licence's copyleft terms apply to that distribution. Internal use inside an organisation is a different question, and this is not legal advice; if you plan to embed it in a commercial product, read the licence text or ask counsel. The upgrade cost is mostly environmental: a Python and Streamlit application, a container image, a .env file holding provider credentials, and optional LangSmith wiring. There is no database or server fleet described in the material. The real recurring cost is the model calls, and the purple-team toggle makes a second call by design, so a two-pass run costs more than a one-pass run. Before adopting it, verify three things: that your chosen provider or local endpoint produces scenarios you would actually run, that the organisation details you intend to enter are acceptable to send to that endpoint, and that the version you deploy matches the interface described in the v0.16 release notes, because the Setup sidebar and readiness gate are recent changes and older documentation may not describe them.

Editorial conclusion

AttackGen fits purple teams and incident response leads who already run tabletop exercises and want a first draft of the scenario document, the inject list and the Navigator layer without writing them by hand. It is the wrong tool if you need a validated adversary emulation plan, if you cannot send your organisation's industry, size and threat group selection to a third-party model provider, or if nobody on the team will maintain a Python environment and an API key. Before adopting it, run the Docker image against your own provider, confirm which model you will point it at, and read the GPL-3.0 terms if you intend to modify and redistribute the code.

Official sources

1. Issues
2. License: GPL-3.0
3. mrwadams/attackgen on GitHub
4. README
5. Releases