generate_layer
Generate an ATT&CK Navigator layer to visualize techniques linked to a threat group, mitigation, or software ID, enabling threat intelligence analysis.
Instructions
Generate an ATT&CK Navigator layer for visualization.
This wraps mitreattack.navlayers.UsageLayerGenerator and produces a
JSON layer highlighting techniques associated with a given ATT&CK ID.
Only the following ATT&CK ID prefixes are supported:
- Gxxxx : groups (intrusion sets)
- Mxxxx : mitigations (course-of-action)
- Sxxxx : software (tool/malware)
- Dxxxx : data components
Technique IDs (Txxxx / Txxxx.xxx) are NOT supported here.
Args:
attack_id: ATT&CK ID (Gxxxx, Mxxxx, Sxxxx, or Dxxxx)
score: Score to assign to all matched techniques in the layer
domain: ATT&CK domain (e.g., "enterprise", "mobile", "ics")
Returns:
{
"success": bool,
"attack_id": "<G/M/S/D ID>",
"domain": "<domain>",
"count": int, # number of techniques in layer
"layer": { ... } | null, # ATT&CK Navigator layer JSON
"message": "<summary or error>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| score | No | ||
| domain | No | enterprise | |
| attack_id | Yes |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |