MITRE Attack Nav layer

layer.json → visualize coverage

Visualize detection coverage in MITRE ATT&CK Navigator with a JSON layer, mapping what has been validated and the gaps in the purple team.

Use it when you want the picture of purple team coverage: the JSON layer (the file with techniques and their scores) is loaded into Navigator and the matrix shows what is covered (validated with exercises) and the gaps. It is the reporting tool for purple teaming: the result of validations (Atomic, CALDERA, PurpleSharp) is dumped into the layer — the detected technique with its score, the unvalidated one without a score. In purple teaming, the layer is the output of the exercise: measured coverage, presented to management and guiding the next validations.

Do not use it as a real security measure: the layer reflects what has been validated (or declared) — a scored technique without validation is an unsupported claim; the layer is built from exercise results, not from what the team believes. Updating the layer is manual (or with management tools): an outdated layer shows coverage that is no longer true. And beware: Navigator visualizes, it does not validate — the layer score does not replace the proof of techniques. For automatic coverage from data, DeTT&CT (or SIEM tools) generate the layer; Navigator is the visualization.