MITRE ATT&CK matrix map

attack-navigator.py → merged layers

Merges ATT&CK Navigator layers with attack-navigator.py, combining coverage from multiple sources into a consolidated matrix.

Use it when you want the consolidated coverage matrix: attack-navigator.py (MITRE's tool) merges layers — the one from rules, the one from purple team validations, the one from telemetry — into a combined matrix with aggregated scores. It's the coverage consolidation: partial layers joined into the program's single map. In purple teaming and reporting, the layer merge presents the full coverage: that declared by rules, that validated with exercises, and that from telemetry — in one view.

Don't use it with incompatible layers: layers are merged with the same framework version (ATT&CK) and with the correct structure — layers from different versions or malformed ones give a wrong merge. And watch out: the merge combines scores (according to the chosen operation: average, maximum) — the interpretation of the combined score is defined beforehand; a merge without criteria mixes declared coverage with validated one. Navigator is the visualization: real coverage validation is in purple team exercises. The merge is used for presentation; the honesty of source layers is the quality of the result.