Mapping detections to MITRE ATT&CK and building a coverage heatmap with Navigator

ATT&CK in one paragraph

MITRE ATT&CK is a knowledge base of adversary tactics (the why, such as Persistence or Credential Access) and techniques (the how, such as T1053 Scheduled Task/Job), with sub-techniques like T1053.005 Scheduled Task. Each technique page lists data sources and detection ideas, which makes it a natural index for a detection library.

Tagging rules

Tag each rule with the most specific technique it detects. Sigma rules use tags such as attack.persistence and attack.t1053.005. One rule can cover several techniques, and one technique often needs several rules for different procedures.

Lab: build a layer from your rules

Collect the ATT&CK tags from a folder of Sigma rules with a short script, count rules per technique, and write a Navigator layer JSON. Open the ATT&CK Navigator web app, load the layer, and look at which tactics are empty.

Snippet

import glob, json, re, collections, yaml
counts = collections.Counter()
for path in glob.glob('rules/**/*.yml', recursive=True):
    rule = yaml.safe_load(open(path))
    for tag in rule.get('tags', []):
        m = re.fullmatch(r'attack\.(t\d{4}(?:\.\d{3})?)', tag)
        if m:
            counts[m.group(1).upper()] += 1
layer = {
  'name': 'Detection coverage', 'domain': 'enterprise-attack',
  'versions': {'layer': '4.5', 'navigator': '5.1'},
  'gradient': {'colors': ['#ffffff', '#3b82f6'], 'minValue': 0, 'maxValue': max(counts.values() or [1])},
  'techniques': [{'techniqueID': t, 'score': n, 'comment': f'{n} rules'} for t, n in counts.items()],
}
json.dump(layer, open('coverage_layer.json', 'w'), indent=2)
print(len(counts), 'techniques tagged')

Reading the map honestly

A colored cell means a rule exists, not that the technique is reliably detected. Coverage depends on data availability across hosts, procedure variety, and whether the rule was tested. Add a second layer for validated rules only, and prioritize techniques relevant to threats against your sector rather than trying to color everything.

Diagram

Rule exists versus technique covered

A heatmap can flatter you.

Rule exists

Evidence. A tagged query in the repository

Tested?. Unknown

Data on all hosts?. Unknown

Technique covered

Evidence. Rule fired in a test or exercise

Tested?. Yes, with several procedures

Data on all hosts?. Confirmed by telemetry checks

Check yourself

1. In ATT&CK, what is T1053.005?

2. How does a Sigma rule express an ATT&CK technique?

3. What does a filled cell on a coverage heatmap reliably prove?