ATT&CK® Navigator

The ATT&CK Navigator is designed to provide basic navigation and annotation of ATT&CK matrices, something that people are already doing today in tools like Excel. We've designed it to be simple and generic - you can use the Navigator to visualize your defensive coverage, your red/blue team planning, the frequency of detected techniques or anything else you want to do. The Navigator doesn't care - it just allows you to manipulate the cells in the matrix (color coding, adding a comment, assigning a numerical value, etc.). We thought having a simple tool that everyone could use to visualize the matrix would help make it easy to use ATT&CK.

The principal feature of the Navigator is the ability for users to define layers - custom views of the ATT&CK knowledge base - e.g. showing just those techniques for a particular platform or highlighting techniques a specific adversary has been known to use. Layers can be created interactively within the Navigator or generated programmatically and then visualized via the Navigator.

Usage

The ATT&CK Navigator is hosted live via GitHub Pages. You can find a live instance of the current version of the Navigator here:

• Enterprise ATT&CK
• Mobile ATT&CK

Users seeking to continue using ATT&CK v6.3 (the last release before sub-techniques) can find live instances of Navigator v2.3.2 here:

• Enterprise ATT&CK v6.3
• Mobile ATT&CK v6.3

Please see Install and Run for information on how to get the ATT&CK Navigator set up locally. Also see Enterprise and Mobile Domains below for information on how to set up the ATT&CK Navigator on local instances to use the two different domains.

Important Note: Layer files uploaded when visiting our Navigator instance hosted on GitHub Pages are NOT being stored on the server side, as the Navigator is a client-side only application. However, we still recommend installing and running your own instance of the ATT&CK Navigator if your layer files contain any sensitive content.

Use our GitHub Issue Tracker to let us know of any bugs or others issues that you encounter. We also encourage pull requests if you've extended the Navigator in a cool way and want to share back to the community!

See CONTRIBUTING.md for more information on making contributions to the ATT&CK Navigator.

Requirements

• Node.js version 8 or greater
• AngularCLI

Supported Browsers

• Chrome
• Firefox
• Internet Explorer¹
• Safari²
• Edge
• Opera

¹ There is a recorded issue with the SVG export feature on Internet Explorer. Because of a missing functionality on SVGElements in that browser, text will not be properly vertically centered in SVGs exported in that browser. We recommend switching to a more modern browser for optimal results. ² There is a recorded issue with using the ATT&CK Navigator on Safari. If the user reloads the page but cancels the action when prompted, the refresh icon in the browser window remains in the cancel reload state. This is believed to be an issue with Safari and not with the application.

Install and Run

First time

1. Navigate to the nav-app directory
2. Run npm install

Serve application on local machine

1. Run ng serve within the nav-app directory
2. Navigate to localhost:4200 in browser

Compile for use elsewhere

1. Run ng build within the nav-app directory
2. Copy files from nav-app/dist/ directory

Running the Navigator offline

1. Install the Navigator as per instructions above.
2. Follow instructions under loading content from local files to configure the Navigator to populate the matrix without an internet connection. For enterprise-attack, use this file. For mobile-attack, use this file. For pre-attack, use this file.

Common issues

1. If serving or compiling the application gives the warning Module not found: can't resolve 'fs', run the command npm run postinstall. The postinstall step usually runs automatically after npm install to patch the fs issue, but in some environments it must be run manually.

Documentation

When viewing the app in a browser, click on the ? icon to the right of the ATT&CK® Navigator title to view its documentation.

Enterprise and Mobile Domains

By default, the ATT&CK Navigator will generate a matrix view of the tactics and techniques matrix for the Enterprise ATT&CK technology domain knowledge base. All tactics and techniques in this domain are contained within the act stage, which is also pre-selected by default.

To instead generate a matrix view of the Mobile ATT&CK technology domain knowledge base, change the domain value in nav-app/src/assets/config.json to mitre-mobile. Use Device Access and Network-Based Effects tactics and techniques in this domain are contained within the act stage, which is pre-selected by default. Obtain Device Access tactics and techniques are contained within the prepare stage, which can be manually selected.

PRE-ATT&CK is included in the matrix view for either domain if the prepare stage is manually selected within the layer control filters.

Layers Folder

The layers folder contains specifications for the layer format as well as example layers and a script demonstrating programatic layer generation. We will continue to add content to this repository as new scripts are implemented. Also, feel free to create pull requests if you want to add new capabilities here!

More information on how layers are used and developed can be found in the ATT&CK Navigator documentation that can be viewed by clicking ? when running the app in a browser, and in the README in the layers folder.

Adding Custom Context Menu Options

To create custom options to the ATT&CK® Navigator context menu using data in the Navigator, objects must be added to the array labeled custom_context_menu_options in nav-app/src/assets/config.json. Each object must have a property label, which is the text displayed in the context menu, and a property url, which is where the user is navigated.

To utilize data on right-clicked technique in the url, parameters surrounded by double curly brackets can be added to the string. For example: using http://www.someurl.com/{{technique_attackID}}} as the url in the custom option would lead to http://www.someurl.com/T1098, if the right-clicked technique's attackID was T1098.

The following data substitutions will be parsed:

• {{technique_attackID}} will be substituted with the ATT&CK ID of the technique, e.g T1234
• {{technique_stixID}} will be substituted with the STIX ID of the technique, e.g attack-pattern--12345678-1234-1234-1234-123456789123
• {{technique_name}} will be substituted with the technique name in lower case and with spaces replaced with hyphens, e.g example-technique-name
• {{tactic_attackID}} will be substituted with the ATT&CK ID of the tactic, e.g TA1234
• {{tactic_stixID}} will be substituted with the STIX ID of the tactic, e.g x-mitre-tactic--12345678-1234-1234-1234-123456789123
• {{tactic_name}} will be substituted with the tactic name in lower case and with spaces replaced with hyphens, e.g example-tactic. This is also equivalent to the x_mitre_shortname property of the tactic.

Optionally, a subtechnique_url field may be added to a custom option. This field will be parsed when the option is used on a sub-technique instead of the normal URL, which will be used for techniques. If subtechnique_url is not used, the technique_ substitutions defined above will refer to the sub-technique object itself.

The following substitutions will be parsed for sub-techniques:

• {{parent_technique_attackID}} will be substituted with the ATT&CK ID of the sub-technique's parent, e.g T1234
• {{parent_technique_stixID}} will be substituted with the STIX ID of the sub-technique's parent, e.g attack-pattern--12345678-1234-1234-1234-123456789123
• {{parent_technique_name}} will be substituted with the name of the sub-technique's parent in lower case and with spaces replaced with hyphens, e.g example-technique-name
• {{subtechnique_attackID}} will be substituted with the ATT&CK ID of the sub-technique, e.g T1234.001
• {{subtechnique_attackID_suffix}} will be substituted with the portion of the ATT&CK ID of the sub-technique after the delimiting period, e.g 001
• {{subtechnique_stixID}} will be substituted with the STIX ID of the sub-technique, e.g attack-pattern--98765432-9876-9876-9876-987654321987
• {{subtechnique_name}} will be substituted with the sub-technique name in lower case and with spaces replaced with hyphens, e.g example-subtechnique-name
• {{tactic_attackID}} will be substituted with the ATT&CK ID of the tactic, e.g TA1234
• {{tactic_stixID}} will be substituted with the STIX ID of the tactic, e.g x-mitre-tactic--12345678-1234-1234-1234-123456789123
• {{tactic_name}} will be substituted with the tactic name in lower case and with spaces replaced with hyphens, e.g example-tactic. This is also equivalent to the x_mitre_shortname property of the tactic.

Example custom context menu objects:

{
    "label": "view technique on ATT&CK website",
    "url": "https://attack.mitre.org/techniques/{{technique_attackID}}",
    "subtechnique_url": "https://attack.mitre.org/techniques/{{parent_technique_attackID}}/{{subtechnique_attackID_suffix}}"
}

{
    "label": "view tactic on ATT&CK website",
    "url": "https://attack.mitre.org/tactics/{{tactic_attackID}}"
}

Loading content from a TAXII server

By default, the Navigator loads content from the MITRE CTI TAXII server at https://cti-taxii.mitre.org.

1. Edit the config.json file in the nav-app/src/assets directory
2. Set the enabled property in taxii_server to true
3. Set the url property in taxii_server to your server's URL
4. Set the values of the collections dictionary to the collection UUIDs your TAXII server has set

Loading content from local files

It's possible to populate the the Navigator using files that consist of bundles of STIX objects, similarly to this file.

1. Put the stix bundles in src/assets. This will tell the server hosting the Navigator to host the data as well.
2. Configure the navigator to use these files. In src/assets/config.json:
   1. Change enterprise_attack_url to the path to the enterprise-attack bundle (e.g assets/enterprise-attack.json).
   2. Change mobile_attack_url to the path to the mobile-attack bundle (e.g assets/mobile-attack.json).
   3. Change pre_attack_url to the path to the pre-attack bundle (e.g assets/pre-attack.json).
   4. Change taxii_server.enabled to false.

Running the Docker File

1. Navigate to the nav-app directory
2. Run docker build -t yourcustomname .
3. Run docker run -p 4200:4200 yourcustomname
4. Navigate to localhost:4200 in browser

Loading Default Layers Upon Initialization

The Navigator can be configured so as to load a set of layers upon initialization. These layers can be from the web and/or from local files. Local files to load should be placed in the nav-app/src/assets/ directory.

1. Set the enabled property in default_layers in src/assets/config.json to true
2. Add the paths to your desired default layers to the urls array in default_layers. For example,

   "default_layers": {
        "enabled": true,
        "urls": [
            "assets/example.json", 
            "https://raw.githubusercontent.com/mitre-attack/attack-navigator/master/layers/data/samples/Bear_APT.json"
        ]
    }

   would load example.json from the local assets directory, and Bear_APT.json from this repo's sample layer folder on Github.
3. Load/reload the Navigator

Default layers from the web can also be set using a query string in the Navigator URL. Refer to the in-application help page section "Customizing the Navigator" for more details.

Disabling Navigator Features

The features array in nav-app/src/assets/config.json lists Navigator features you may want to disable. Setting the enabled field on a feature in the configuration file will hide all control elements related to that feature.

However, if a layer is uploaded with an annotation or configuration relating to that feature it will not be hidden. For example, if comments are disabled the ability to add a new comment annotation will be removed, however if a layer is uploaded with comments present they will still be displayed in tooltips and and marked with an underline.

Features can also be disabled using the create customized Navigator feature. Refer to the in-application help page section "Customizing the Navigator" for more details.

Embedding the Navigator in a Webpage

If you want to embed the Navigator in a webpage, use an iframe:

<iframe src="https://mitre-attack.github.io/attack-navigator/enterprise/" width="1000" height="500"></iframe>

If you want to imbed a version of the Navigator with specific features removed (e.g tabs, adding annotations), or with a default layer, we recommend using the create customized Navigator feature. Refer to the in-application help page section "Customizing the Navigator" for more details.

The following is an example iframe which embeds our *Bear APTs layer with tabs and the ability to add annotations removed:

<iframe src="https://mitre-attack.github.io/attack-navigator/enterprise/#layerURL=https%3A%2F%2Fraw.githubusercontent.com%2Fmitre%2Fattack-navigator%2Fmaster%2Flayers%2Fdata%2Fsamples%2FBear_APT.json&tabs=false&selecting_techniques=false" width="1000" height="500"></iframe>

Related MITRE Work

CTI

Cyber Threat Intelligence repository of the ATT&CK catalog expressed in STIX 2.0 JSON.

ATT&CK

ATT&CK® is a curated knowledge base and model for cyber adversary behavior, reflecting the various phases of an adversary’s lifecycle and the platforms they are known to target. ATT&CK is useful for understanding security risk against known adversary behavior, for planning security improvements, and verifying defenses work as expected.

https://attack.mitre.org

STIX

Structured Threat Information Expression (STIX™) is a language and serialization format used to exchange cyber threat intelligence (CTI).

STIX enables organizations to share CTI with one another in a consistent and machine readable manner, allowing security communities to better understand what computer-based attacks they are most likely to see and to anticipate and/or respond to those attacks faster and more effectively.

STIX is designed to improve many different capabilities, such as collaborative threat analysis, automated threat exchange, automated detection and response, and more.

https://oasis-open.github.io/cti-documentation/

Notice

Copyright 2020 The MITRE Corporation

Approved for Public Release; Distribution Unlimited. Case Number 18-0128.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

This project makes use of ATT&CK®

ATT&CK® Terms of Use