MITRE ATT&CK Navigator

MITRE ATT&CK Navigator is a free web-based tool for visualizing, annotating, and comparing coverage of adversary tactics and techniques from the MITRE ATT&CK knowledge base.

Threat Detection open-source mitre-attack detection-engineering purple-team

Overview

MITRE ATT&CK Navigator is a free, open-source web application developed by MITRE for exploring, annotating, and comparing coverage of adversary tactics and techniques documented in the ATT&CK knowledge base. Analysts use the Navigator to build heatmaps that show which techniques an organization's detection rules, threat intelligence reports, or red team activity covers. Layers can be created manually, imported from ATT&CK data, or generated by tools such as ATT&CK Workbench and Atomic Red Team. The Navigator supports Enterprise, Mobile, and ICS matrices, and layers can be exported as JSON for sharing or version control. It is widely used in detection engineering, purple team exercises, gap analysis, and security program reporting, and it can be self-hosted or used via the hosted version.

Primary Use Cases

✔ Visualizing detection coverage as heatmaps mapped to the MITRE ATT&CK Enterprise, Mobile, or ICS matrices to identify defensive gaps.

✔ Mapping threat intelligence reports and adversary group behavior to specific ATT&CK techniques for contextualized threat modeling.

✔ Planning and reporting purple team exercises by comparing red team activity layers against blue team detection layers in a single view.

Frequently Asked Questions

Yes. The Navigator is free and open-source, released under the Apache 2.0 license by MITRE. It can be used directly via the hosted GitHub Pages site or self-hosted inside an organization's environment.

As of September 2026, the current release is ATT&CK Navigator 5.x, aligned with ATT&CK v18. The 5.x line supports the latest ATT&CK data format, improved layer management, better rendering performance for large layers, and enriched metadata for techniques and mitigations.

No. The hosted version runs entirely in the browser. Layers are stored locally and can be exported as JSON files for sharing, version control, or import into another instance. No data is uploaded to MITRE unless a user explicitly shares it.

Yes. Layers are saved as JSON files, which makes them easy to share with teammates, store in Git, attach to reports, or import into automated pipelines. Many organizations keep Navigator layers in version control alongside detection rules to track coverage changes over time.

Yes. Navigator layers can be generated programmatically from tools such as ATT&CK Workbench, Atomic Red Team, MITRE CALDERA, and custom scripts that map Sigma or SIEM rules to ATT&CK techniques. The JSON layer format is well documented, making automation straightforward.

Metadata

Official Website Visit Website

Category Info

Threat Detection covers tools and frameworks used to design, organize, visualize, and validate detection coverage against known adversary tactics, techniques, and procedures.

Added On

September 16, 2026

Last Updated

September 16, 2026