mhaggis/ATT&CK Navigator Layer Generator

ATT&CK Navigator Layer Generator Skill

Overview

ATT&CK Navigator layers are JSON files that visualize technique coverage on the MITRE ATT&CK matrix. This skill covers generating layers for three primary use cases:

1. Coverage heatmaps — Show which techniques have detections (and how many)
2. Threat actor mapping — Highlight techniques used by a specific group
3. Gap analysis — Compare your coverage against a threat profile

Navigator Layer JSON Format

Every layer follows this structure:

{
  "name": "Layer Name",
  "versions": {
    "attack": "18.1",
    "navigator": "5.3.1",
    "layer": "4.5"
  },
  "domain": "enterprise-attack",
  "description": "Layer description",
  "techniques": [
    {
      "techniqueID": "T1059.001",
      "tactic": "execution",
      "score": 75,
      "color": "#66b2ff",
      "comment": "3 Sigma rules, 2 Splunk ESCU rules",
      "enabled": true
    }
  ],
  "gradient": {
    "colors": ["#ff6666", "#ffe766", "#8ec843"],
    "minValue": 0,
    "maxValue": 100
  }
}

Key Fields

| Field | Type | Purpose | |-------|------|---------| | techniqueID | string | MITRE technique ID (e.g., T1059.001) | | tactic | string | Tactic shortname (required for sub-techniques that appear in multiple tactics) | | score | number | 0–100, drives gradient coloring | | color | string | Hex color override (takes precedence over score gradient) | | comment | string | Hover text with details | | enabled | boolean | Whether technique is visible |

Color Conventions

| Color | Meaning | |-------|---------| | #8ec843 (green) | Good coverage (score 70–100) | | #ffe766 (yellow) | Partial coverage (score 30–69) | | #ff6666 (red) | Weak/no coverage (score 0–29) | | #6baed6 (blue) | Threat actor uses this technique | | #ffffff (white) | Not assessed / not applicable |

Use Case 1: Coverage Heatmap

Visualize detection coverage across all techniques. Score is based on number and quality of detections.

Using MCP tools:

1. get_technique_ids()                    → Get all covered technique IDs
2. analyze_coverage()                     → Get tactic-level breakdown
3. generate_coverage_layer(covered_ids)   → Generate the layer JSON

Scoring formula (suggested):

• 1 detection = score 25
• 2–3 detections = score 50
• 4–5 detections = score 75
• 6+ detections = score 100
• Bonus: +10 for each additional source type (Sigma + Splunk + Elastic)

Use Case 2: Threat Actor Mapping

Highlight all techniques attributed to a specific threat group.

Using MCP tools:

1. search_groups("APT29")                 → Find group ID (G0016)
2. get_group_techniques("G0016")          → Get technique list
3. generate_group_layer("G0016", "APT29") → Generate the layer

Use Case 3: Gap Analysis

Compare your detection coverage against a target set of techniques (e.g., a threat actor's TTPs).

Using MCP tools:

1. get_technique_ids()                                → Your covered IDs
2. get_group_techniques("G0016")                      → Target IDs
3. generate_gap_layer(covered, target, "APT29 Gaps")  → Gap layer

Gap layer color scheme:

• Green = covered (you have detections AND the threat actor uses it)
• Red = gap (threat actor uses it but you have NO detection)
• Gray = not used by this actor

Generating Layers Programmatically

If MCP tools aren't available, build the JSON directly:

import json

def make_layer(name, techniques, description=""):
    return {
        "name": name,
        "versions": {"attack": "18.1", "navigator": "5.3.1", "layer": "4.5"},
        "domain": "enterprise-attack",
        "description": description,
        "techniques": techniques,
        "gradient": {
            "colors": ["#ff6666", "#ffe766", "#8ec843"],
            "minValue": 0,
            "maxValue": 100,
        },
    }

techniques = [
    {"techniqueID": "T1059.001", "score": 80, "comment": "5 detections"},
    {"techniqueID": "T1053.005", "score": 40, "comment": "1 detection"},
]

layer = make_layer("My Coverage", techniques, "Detection coverage as of 2026-02")
with open("coverage_layer.json", "w") as f:
    json.dump(layer, f, indent=2)

Viewing Layers

1. Open ATT&CK Navigator
2. Click Open Existing Layer → Upload from local
3. Select the generated JSON file

Or host Navigator locally:

git clone https://github.com/mitre-attack/attack-navigator.git
cd attack-navigator/nav-app
npm install && npm start

Tips

• Layer per audience: Executives want simple red/green; analysts want score gradients with comments.
• Version pin: Always set versions.attack to match the ATT&CK version your analysis used.
• Combine layers: Navigator supports overlaying multiple layers — useful for comparing before/after or two threat actors.
• Export as SVG: Navigator can export layers as SVG for inclusion in reports.