skills.rest
MHaggis
MHaggisCOMMUNITY
Explore all skills by this author →
Website𝕏@M_haggisGitHub

ATT&CK Navigator Layer Generator

Generate MITRE ATT&CK Navigator JSON layers for detection coverage and gap analysis.

471|74|Updated Jan 13, 2026
Search Tags:#visualization#gap analysis#threat intelligence#navigator#mitre att&ck#detection engineering
One-click install
npx skills add https://github.com/MHaggis/Security-Detections-MCP --skill att-ck-navigator-layer-generator
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ATT&CK Navigator Layer Generator
Source: https://github.com/MHaggis/Security-Detections-MCP/tree/main/.claude/skills/attack-navigator-generator
Command: npx skills add https://github.com/MHaggis/Security-Detections-MCP --skill att-ck-navigator-layer-generator

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill automates the creation of MITRE ATT&CK Navigator layers, simplifying the visualization of security detection coverage, threat actor TTPs, and identifying gaps in defenses.

Core Features & Use Cases

  • Coverage Heatmaps: Visualize which techniques have detections and their quality.
  • Threat Actor Mapping: Highlight techniques used by specific threat groups.
  • Gap Analysis: Compare your detection coverage against known threat actor behaviors.
  • Use Case: Generate a heatmap showing your organization's detection coverage for APT29's known techniques, highlighting areas where new detections are needed.

Quick Start

Use the ATT&CK Navigator Layer Generator skill to create a coverage heatmap based on your current detection IDs.

Frequently Asked Questions about ATT&CK Navigator Layer Generator

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I visualize MITRE ATT&CK detection coverage for specific threat actors?▼

You can visualize MITRE ATT&CK detection coverage by generating Navigator JSON layers that map your technique IDs against threat actor TTPs. This creates heatmaps highlighting where your defenses successfully overlap with known threat group behaviors.

What is the best way to automate threat actor TTP mapping for gap analysis?▼

Automating threat actor TTP mapping for gap analysis involves generating JSON layers that compare your provided detection technique IDs against known threat group data. This process highlights defensive gaps by visualizing the difference between your coverage and adversary behaviors.

Can I generate ATT&CK Navigator layers using just technique IDs?▼

Yes, you can generate ATT&CK Navigator layers using just technique IDs. The generator uses your provided technique IDs as input to build coverage heatmaps and threat overlays without requiring additional complex data structures.

How do I create a comparative gap analysis layer for my security detections?▼

To create a comparative gap analysis layer, you provide your current detection technique IDs and relevant threat group data. The generator outputs a Navigator JSON file that visually contrasts your existing security coverage against adversary techniques.

Does this ATT&CK Navigator layer generator support coverage heatmaps for detection engineering?▼

Yes, this ATT&CK Navigator layer generator fully supports coverage heatmaps for detection engineering. It takes your technique IDs and produces JSON layers that visually represent the presence and quality of your security detections.

What format do I need for threat group data to map TTPs in ATT&CK Navigator?▼

To map TTPs in ATT&CK Navigator, you need to provide threat group data alongside your technique IDs. The generator processes this input to automatically produce JSON layers that highlight the specific techniques used by those threat actors.

Related Skills

Explore More Software Engineering Skills→
jfrometajfrometa

red-team-tactics

Map adversary techniques to MITRE ATT&CK phases for red-team simulations.

Community
Basic
YukiIto1999YukiIto1999

analyzing-apt-group-with-mitre-navigator

Map APT group techniques to MITRE ATT&CK Navigator layers as JSON.

Community
Intermediate
4lerman4lerman

threat-detection

Score hunting hypotheses against MITRE ATT&CK techniques and IOC data.

Community
Advanced
YukiIto1999YukiIto1999

analyzing-threat-actor-ttps-with-mitre-navigator

Map threat actor TTPs to MITRE ATT&CK Navigator and generate layer JSON files.

Community
Intermediate