ATT&CK Agent

Ask about real-world cyber threats. A Bedrock (Qwen3 32B) agent reasons over a Neo4j graph of ~4,800 MITRE ATT&CK objects using four tools, then explains the risks in plain language. Runs on a dedicated worker node.

Start broad. Ask something like What are detection strategies for OS Credential Dumping?

The answer comes back as a list. Take any item from that list and prepend it to your first question to drill down: What are the Tools to Watch For in detection strategies for OS Credential Dumping?

Keep iterating the same way. Ask for details about Mimikatz in Tools to Watch For in detection strategies for OS Credential Dumping, and so on down the chain.

This prompting technique extracts the database's own terms and uses them directly in the next prompt. That keeps a weaker model from getting confused, and it reduces the need to flood the model context with tokens explaining how to map a question onto what actually exists in the database.

The agent is thinking and querying the ATT&CK graph...

Source

strands_agents_study attack-data-local-agent