feat(tools): get_attack_map — CVE to MITRE ATT&CK technique mapper + CLI subcommand (+81 tests)

[manus-use]

Summary

Adds get_attack_map — a new tool that maps CVEs to MITRE ATT&CK techniques and tactics by resolving the CVE → CWE → CAPEC → ATT&CK chain. Also wires up the manus-agent attack-map CLI subcommand.

What it does

Given a CVE identifier, the tool:

1. Fetches CWE weaknesses from NVD API v2.0
2. Resolves CWE → CAPEC by scraping CAPEC references from cwe.mitre.org
3. Resolves CAPEC → ATT&CK by scraping technique mappings from capec.mitre.org
4. Falls back to curated mappings when CAPEC resolution fails (covers 18 common CWEs including XSS, SQLi, command injection, buffer overflow, deserialization, SSRF, XXE, path traversal, etc.)
5. Returns structured output with technique IDs, names, tactics (kill-chain phases), mapping paths, and ATT&CK URLs

CLI Usage

manus-agent attack-map CVE-2024-3094
manus-agent attack-map CVE-2024-3094 --output json | jq .techniques

Example Output

## ATT&CK Mapping: CVE-2024-3094

**Weaknesses:** CWE-506

**Kill-Chain Coverage:**
  • Initial Access

**ATT&CK Techniques:**

  [T1195] Supply Chain Compromise
    Tactic: Initial Access
    Path:   CWE-829 → T1195 (curated mapping)
    URL:    https://attack.mitre.org/techniques/T1195/

---
Total: 1 technique(s) across 1 tactic(s)

Why this matters

Existing tools tell you what a vulnerability is (NVD, EPSS, KEV, CWE). This tool tells you how it fits into real-world attack campaigns — which ATT&CK techniques could exploit it and which defensive controls apply. This bridges the gap between vulnerability management and threat-informed defense.

Design decisions

• Zero new dependencies — uses only requests (already in deps)
• Multi-source resolution: CAPEC scraping preferred, curated fallback for reliability
• Retry/back-off on all HTTP calls (429, 5xx, timeouts)
• NVD_API_KEY support for higher rate limits
• Graceful degradation — if CAPEC scraping fails, curated mappings still provide useful results
• Kill-chain ordering — tactics sorted by ATT&CK kill-chain phase
• Deduplication — same technique from multiple CWEs appears only once
• Strands TOOL_SPEC interface — fully compatible with the agent framework

Files changed

• src/manus_agent/tools/get_attack_map.py — new tool implementation
• src/manus_agent/cli.py — CLI parser, runner, dispatch, and _SUBCOMMANDS registration
• tests/test_attack_map.py — 81 fully-mocked tests

Test coverage (81 tests)

Category	Count
TOOL_SPEC contract	5
Input validation	5
NVD CWE extraction	7
CWE → CAPEC resolution	5
CAPEC → ATT&CK resolution	6
Technique name extraction	5
Tactic extraction	4
Core mapping logic	8
Fallback mapping validation	6
Text formatting	5
JSON formatting	3
Strands tool handler	5
CLI-facing function	2
CLI subcommand	5
HTTP retry	5
Edge cases	5

All tests are fully mocked — no real HTTP calls.

Open PRs checked (no overlap)

Checked all 100+ open PRs (#77–#187). No existing open or merged PR covers ATT&CK technique mapping, CAPEC resolution, or CWE-to-tactic mapping. Closest PRs are:

• feat(tools): classify-refs — NVD reference URL classifier with 89 tests #166 (classify-refs — URL classification, different scope)
• feat(cli): add manus-agent cwe subcommand for CWE weakness lookup #124 (cwe subcommand — CWE description lookup, no ATT&CK mapping)
• feat: add cve-enrich tool and CLI subcommand for multi-source CVE enrichment #170 (cve-enrich — multi-source enrichment, no ATT&CK chain)

Test results

1239 passed, 3 deselected, 0 failures