MITRE ATLAS and OWASP coverage
The two attack-knowledge catalogues CID222 ships offline, what the risk analyst may cite from them, and what they do not claim.
- Version: 0.4
- Feature: risk.llm_review
- Role: admin_user, viewer
CID222 ships the whole MITRE ATLAS release and six OWASP AI-security documents as database tables inside the product image. The risk analyst cites them by identifier, and every identifier it names is checked against what is actually loaded.
The problem
A verdict that says "this looks like a prompt-injection attempt" is an opinion. A verdict that says "AML.T0051" is a claim against a public catalogue that a security team already uses — but only if the identifier is real, only if it means what the catalogue says, and only if it still resolves next year when the catalogue has moved on. An appliance with no internet cannot look any of that up at the moment it is asked.
How CID222 does it
Both catalogues ship inside the image
Neither is downloaded. A pinned snapshot travels in the nestjs-core image and loads itself at
boot: no administrator action, no seeder run, no network.
| Catalogue | What is loaded |
|---|---|
| MITRE ATLAS | The complete pinned release — tactics, techniques, sub-techniques, mitigations, case studies, relationships, references and cross-references |
| OWASP | Six documents — the LLM Top 10 for 2026 and 2025, the Agentic Top 10, the agentic threat taxonomy, the ML Security Top 10, and the AI Exchange threats and controls — with OWASP's own crosswalks to ATLAS as resolvable links |
The loader verifies the snapshot's hash and version against a lock file before writing anything. An edited snapshot is refused, not loaded. Any failure is logged and never thrown: a gateway serving traffic with last release's catalogue beats one that will not start.
Identifiers survive the catalogue changing
An object the upstream release drops is retired, never deleted. An old verdict citing it still resolves to a name, marked with the release that dropped it. The only identifier that returns nothing is one no release ever carried.
Three layers, deliberately different sizes
The tables hold everything and are looked up on demand. A smaller retrieval slice becomes attack-knowledge cards the analyst reads with every review — ATLAS techniques and sub-techniques, OWASP risks, threats and candidates. Mitigations and controls are deliberately not cards: they reach a prompt only when the model fetches them by tool, because growing the card corpus costs a re-embedding pass on every refresh.
Where it shows
Both catalogues are tabs on the LLM Risk Analyst page: MITRE ATLAS and OWASP. ATLAS renders as the tactic-by-technique matrix with a detail sheet per object; OWASP renders as its documents in fixed order. Identifiers in an analyst's verdict are links into those sheets.
A review's own findings surface as Techniques (ATLAS), Risks (OWASP) and Controls (OWASP).
The read APIs sit under /admin/atlas and /admin/owasp. They carry no tenant data, no user data
and no secret — published reference material — so nothing there is tenant-scoped.
Limits and known gaps
- This is a citation vocabulary, not detection coverage. Nothing maps every detection onto an ATLAS technique automatically. An identifier appears when the LLM risk analyst names one in a review and the verification step confirms it exists in the loaded release. A technique absent from your dashboard means no review cited it, not that the product cannot detect it.
- It requires the analyst. The catalogues load on every appliance, but the surfaces that use them belong to the LLM risk analyst, which is licence-gated and runs only when its compose profile is started. Without it the tabs are reference reading.
- Verification confirms existence, not correctness. The check is that a cited identifier is a real object in the loaded release. Whether it is the right technique for that prompt is the model's judgement, reviewed by a person.
- The catalogue is as current as the image. Both are pinned snapshots. An appliance that has not taken a product update is citing the release it shipped with, and there is no separate data channel that updates them.
- A technique in two tactics is counted twice on the matrix. Cells exceed object counts by design, so a cell total is not an object total.
- There is no coverage report. Nothing in the product states which ATLAS techniques CID222's detectors do or do not address. Any such claim would have to be written by hand and would go stale on the next release.
Related
- Toxicity and attack detection — the detectors that produce the findings an analyst reviews.
- Regulatory mapping — the compliance-side mapping, which is computed rather than cited.
- LLM Risk Analyst — running the reviews these catalogues serve.
Last updated on