ATT&CK Navigator
MITRE web tool for annotating ATT&CK matrices and visualizing detection and adversary coverage.
Technical Architecture & Overview
The ATT&CK Navigator is the official MITRE tool for browsing and annotating ATT&CK matrices. Analysts mark techniques for detection coverage, threat relevance, or red team plans, export layer files for sharing, and compare layers to expose gaps. It runs hosted, locally, or in Docker, and layer files integrate with tooling such as DeTT&CT and Caldera.
Targeted Technical Use Cases
Mapping and communicating detection coverage and adversary emulation plans against ATT&CK.
Evaluation & Trade-offs
Core Strengths
- +The canonical ATT&CK visualization tool.
- +Layer files are a common interchange format.
- +Free with no telemetry or signup.
Trade-Offs & Limitations
- -Annotation only; scoring pipelines need companion tools.
- -Layers can become stale without an update process.
Defensive Security Application
Communicating detection gaps and coverage priorities in a standard visual format.
Frequently Asked Questions
What is ATT&CK Navigator?→
The ATT&CK Navigator is the official MITRE tool for browsing and annotating ATT&CK matrices. Analysts mark techniques for detection coverage, threat relevance, or red team plans, export layer files for sharing, and compare layers to expose gaps. It runs hosted, locally, or in Docker, and layer files integrate with tooling such as DeTT&CT and Caldera.
What is ATT&CK Navigator used for?→
Mapping and communicating detection coverage and adversary emulation plans against ATT&CK.
What are the strengths of ATT&CK Navigator?→
- +The canonical ATT&CK visualization tool.
- +Layer files are a common interchange format.
- +Free with no telemetry or signup.
What are the limitations of ATT&CK Navigator?→
- +Annotation only; scoring pipelines need companion tools.
- +Layers can become stale without an update process.
How is ATT&CK Navigator used defensively?→
Communicating detection gaps and coverage priorities in a standard visual format.