MITRE ATT&CK Navigator

The ATT&CK Navigator is a simple, flexible tool for exploring and annotating ATT&CK matrices, replacing manual methods like spreadsheets. It helps users map defensive coverage, plan red/blue team activities, track detected techniques, and more. With features like colour coding, comments, and numerical values, it makes ATT&CK more accessible through intuitive visualisation.

A key feature is customisable "layers," allowing users to focus on specific platforms, highlight adversary techniques, or filter data. Layers can be created interactively or generated programmatically for later use.

Watch the MITRE ATT&CK Navigator overview on YouTube

What Navigator does

Navigator turns an ATT&CK matrix into a purpose-specific layer. A layer can select techniques, assign colours or scores, record comments, compare assessments, and export the result for review. The visual is useful only when its purpose and scoring rules are documented.

1 Define purpose→ 2 Select techniques→ 3 Score and annotate→ 4 Review evidence→ 5 Export layer

Choose your journey

You do not need to complete every section. Choose the journey that matches your goal and available environment.

01 Install Navigator offline Prepare Node.js, Angular, Navigator, and ATT&CK data on an internet-connected machine, then transfer them into the isolated lab. Complete when the local Enterprise, Mobile, and ICS data sources open. Advanced · 2 Ubuntu VMs · Several hours

02 Build and score layers Create a layer, select group or manual techniques, apply colours, and define red-team or blue-team scores. Complete when another analyst can explain every selection and score. Beginner · Working Navigator · 45–75 min

03 Compare and export Combine adversary layers and export the assessment as JSON, a table, or SVG. Complete when the exported artefact preserves the layer's meaning. Intermediate · Completed layers · 30–60 min

04 Practise the workflow Use a browser simulation or reproduce the complete workflow in your own lab. Complete when you can defend the mapping and export a reviewable layer. Beginner · Browser or self-hosted · 20 min–several hours

Start with the purpose, not the colour

Decide whether a layer represents observed behaviour, visibility, detection, validation, adversary intelligence, or a plan. Record what each score and colour means before selecting techniques.

Lab Setup for Proof of Concept

In this proof of concept, MITRE ATT&CK Navigator was installed and configured in an air-gapped Ubuntu environment. Layers were created using the Tactics, Techniques, and Procedures (TTPs) of well-known Advanced Persistent Threats (APTs). These layers were rendered in different colours and combined to demonstrate how MITRE ATT&CK Navigator can be used for both red team and blue team planning.

Host	OS	Role	IP Address
Fortigate	Fortios 7.6.0	Firewall/Router	192.168.1.10 (WAN) / 10.0.0.1 (LAN)
Ubuntu	Ubuntu 24.04	Internet-Connected VM	10.0.0.200
Mitre	Ubuntu 24.04	Air-gapped VM	10.0.0.150

Continue with a journey

Install offlinePrepare and transfer the complete Navigator application and ATT&CK data. Build a layerCreate, select, colour, score, and annotate techniques. Go hands-onPractise in the browser or complete the self-hosted challenge.

Official resources

• Use the MITRE ATT&CK knowledge base when checking technique definitions and relationships.
• Use the ATT&CK Navigator repository for source code, releases, and deployment guidance.
• Watch the preserved Navigator demonstration and layer workflow video for additional examples.

Where to go next

Understanding Threat FrameworksReturn to evidence-based mapping, limitations, and framework concepts. Understanding Security ValidationLearn how controlled tests provide evidence for defensible coverage claims. Explore MITRE CalderaRun authorised ATT&CK-aligned emulation and inspect operation evidence.