Sources & licences

TIE builds on public datasets that other people maintain. This page lists every one it uses, what it uses it for, and the licence it carries. It is generated from the published data itself rather than written by hand, so it cannot drift from what is actually in use.

Required notices

These sources are usable on condition that the notice travels with the data. TIE's build refuses to publish an artifact whose licence requires a notice it does not carry, and this page refuses to render without them.

attack-enterprise, attack-software · MITRE ATT&CK Terms of Use

© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK® is a registered trademark of The MITRE Corporation.

microsoft-mapping · CC BY 4.0

Threat actor name mapping © Microsoft, licensed CC BY 4.0, from microsoft/mstic PublicFeeds/ThreatActorNaming.

Entity and threat-actor names

The alias map that lets TIE treat Cozy Bear, Midnight Blizzard and UNC2452 as one actor is built weekly from these, at pinned revisions. Last built .

SourceRevisionEntriesLicence
attack-enterprise 19.2pinned 2026-08-26 178 MITRE ToU
attack-software 19.2pinned 2026-08-26 842 MITRE ToU
misp-threat-actor 91e6b5c6pinned 2026-08-26 1044 CC0 1.0
misp-microsoft-activity-group 91e6b5c6pinned 2026-08-26 179 CC0 1.0
misp-ransomware 91e6b5c6pinned 2026-08-26 2135 CC0 1.0
misp-producer 91e6b5c6pinned 2026-08-26 135 CC0 1.0
microsoft-mapping bb6f29f3pinned 2026-08-26 170 CC BY 4.0

News and research sources

TIE reads public RSS and Atom feeds, summarises what it finds, and links to the original. It does not republish article text: every story on this site credits its publisher by name and links out to them. If you publish one of these feeds and would rather TIE did not read it, say so and it will stop.

What TIE adds, and how to tell

Summaries, story grouping, categories, priority ordering and the Desk's analyst takes are machine-generated by TIE and are not claims made by any source above. Where a page shows a relationship between two entities, it says whether that came from a curated public dataset or from TIE observing the two together in its own coverage. The two are never presented as the same kind of statement.

Corrections

Actor naming is contested by nature, and TIE's alias map inherits every disagreement its sources have with each other. Where the sources conflict, TIE keeps them apart rather than picking a winner. If something here is wrong, it is worth telling us.