The Problem
A CVE number tells you something is broken — it doesn't tell you what an adversary does with it. Detection engineers and threat-informed defenders think in techniques and tactics, but vulnerability data arrives stripped of that context, leaving two teams staring at the same finding in two different languages.
What It Does
Orthrus fetches the live MITRE ATT&CK→CVE mapping and tags each CVE in your navi.db with its impact and technique. Every finding gains an attacker's-eye label — which technique it enables, what the adversary gets — so vulnerability data finally speaks the language of threat-informed defense.
Key Capabilities
- Live ATT&CK→CVE mapping fetch — pulls the current public mapping at run time, so technique tags reflect today's adversary knowledge, not last quarter's snapshot.
- Per-CVE technique and impact tags — each finding is labeled with what it actually lets an adversary do — the context that turns a CVE number into a decision.
- Attacker's-eye framing on your own data — technique context lands directly on the findings you already track, not in a separate feed.
- Gated writes — technique tags are proposed, human-approved, and logged like every other write in the pack.
How It Works
Orthrus pulls the ATT&CK→CVE mapping live, matches it against the CVEs in your local navi.db, and proposes technique and impact tags. All writes are proposed, human-approved, and logged.
Who It's For
Threat-informed defense programs mapping coverage to techniques, and detection engineers who want to know which techniques their unpatched estate actually enables.
Proof Points
Runs across the same reference environment of 268 assets as the rest of the pack, layering technique context onto the estate's findings — including the 2,631 KEV findings Laelaps surfaced. Technique coverage is bounded by the public ATT&CK→CVE mapping; not every CVE has a mapped technique, and Orthrus doesn't pretend otherwise.
Works Better With
Orthrus pairs naturally with Laelaps — KEV says "exploited," ATT&CK says "here's the play" — and feeds On the Scent, where technique context enriches the executive exposure view.
Why It's Different
- Attacker's-eye framing on your findings — not another threat feed to read, but context on the vulns you already track.
- Complements KEV — Laelaps says a vuln is exploited; Orthrus says how it's used.
- Bridges two teams — vuln management and detection engineering finally sort the same list the same way.