How to build a detection coverage layer in ATT&CK Navigator

ATT&CK Navigator lets you build a layer, a custom view of the ATT&CK matrix, and annotate techniques with colours, comments and scores. A coverage layer records which techniques you can detect or block today, so gaps stand out and you can pick the next fix on evidence.

What Navigator is

The project README describes the Navigator as a web app for basic navigation and annotation of ATT&CK matrices. It does not prescribe a use. You can visualise defensive coverage, plan red or blue team activity or track how often a technique is seen.

Its main feature is layers. A layer can show only the techniques for one platform, or highlight techniques a specific adversary is known to use. You can create layers by hand or generate them programmatically. Cells accept colour coding, comments and numerical values.

Step 1: decide the question

A layer without a question becomes wall art. Pick one:

• Which techniques from this advisory can we detect?
• Which techniques can we block on developer laptops?
• Where are we blind in our cloud accounts?

Step 2: narrow the matrix

Filter to the platforms you run. If you have no macOS fleet, hide macOS. A smaller matrix is easier to review honestly.

Step 3: seed a threat layer

From a report you trust, such as a CISA advisory, mark the techniques it describes. Keep this layer separate from your coverage layer. The advisory layer says what an adversary does. The coverage layer says what you do about it.

Step 4: score your coverage

Use a simple scale and write it down on the layer itself, for example:

• 0: no detection and no prevention
• 1: logs exist but nobody reviews them
• 2: an alert exists but is untested
• 3: an alert exists and was tested against a safe simulation

Add a comment for each cell with the data source and the owner. Numbers without owners decay quickly.

Step 5: compare the two layers

Look for techniques that appear in the advisory layer and score 0 or 1 in yours. Those are your short list. Pick two or three, not thirty.

Step 6: test, then update

Test a detection with a safe, approved simulation in a non-production setting. If it fires, raise the score. If it does not, write down why.

Keep in mind

• MITRE notes that technique mappings in its content reflect only a subset of what open-source reporting offers, so an empty cell on a threat layer is not proof an adversary never uses that technique.
• Colour is not truth. A green cell means a tested control, not a safe system.
• Save layers as files in version control so you can show change over time.

Quick check

Sources

• ATT&CK Navigator README
• MITRE ATT&CK groups

Last reviewed: 19 October 2026.