MITRE ATT&CK Navigator

attack-navigator (web) # layer JSON

Visualizes the SOC's detection coverage over the MITRE ATT&CK framework with a JSON layer, identifying telemetry gaps.

Use it when you want to answer 'which techniques can we detect and which not?': the Navigator paints an ATT&CK matrix colored by technique, and the JSON layer (the scoring file generated or hand-edited) defines which techniques have detection, which have partial telemetry, and which are blind. It is the planning tool for detection engineering: the coverage map is presented to management, compared between quarters, and guides which rules to build. It is also the standard format for sharing coverage between teams (vendors publish their layers as reference).

Do not use it as a real security measure: the layer reflects what the team says it covers, not what works — a technique marked as 'detected' may have a rule that never fires. The map's coverage must be validated (with Atomic Red Team or PurpleSharp) before trusting it. Also, do not use it for analyzing a specific incident: the Navigator is for planning and reporting, not hunting. And watch out for the format: the JSON layer has a specific structure (version, techniques with score); hand-editing without knowing it breaks loading — use the Navigator's editor or generate the JSON from management tools.