MITRE ATT&CK data source repository query

CTI Butler
1

I see MITRE ATT&CK maintain 2 repositories of STIX data

and

What is the difference between the two, if any? And if there is a difference, which version does the CTI Butler use?

2

To answer your questions directly;

  1. we use the data here for CTI Butler GitHub - mitre-attack/attack-stix-data: STIX data representing MITRE ATT&CK
  2. with regards to the difference

GitHub - mitre-attack/attack-stix-data: STIX data representing MITRE ATT&CK contains only the final STIX 2.1 bundles.

GitHub - mitre/cti: Cyber Threat Intelligence Repository expressed in STIX 2.0 contains final STIX 2.0 bundles AND the individual objects themselves.

Unless you have reason to use 2.0 (unlikely) use the 2.1 versions of the objects for your projects