Export ATT&CK Navigator Layer
export_attack_navigatorGenerate a MITRE ATT&CK Navigator layer (enterprise-attack) as a heatmap of technique coverage, scored by count of threats using each technique, for one actor or platform-wide.
Instructions
Export a MITRE ATT&CK Navigator layer (enterprise-attack) for visualization. Pass actor= to score techniques attributed to one actor, or all=true for platform-wide coverage. score is PER TECHNIQUE — the number of corpus threats using it (for the actor, or platform-wide) — so the heatmap ranks within a tactic, not just between tactics; the unit is stated in the layer's description and metadata. Returns {name, versions, domain, description, techniques:[{techniqueID, score, color, comment}], gradient, metadata}. Capped at 600 techniques; when the tail is dropped, metadata carries a 'truncated' entry saying so. ATLAS (AML.*) and non-enterprise ids are excluded, since the layer domain is enterprise-attack.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| all | No | If true, build a platform-wide coverage layer from MITRE coverage instead of a single actor | |
| actor | No | Threat-actor name or alias whose techniques to score (e.g. "APT29") |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | ||
| domain | No | ||
| gradient | No | ||
| metadata | No | ||
| versions | No | ||
| techniques | Yes | ||
| description | No | Includes the scoring unit ("Score = …"). |