What is ATT&CK Intelligence View?

A free, community-focused browser app for exploring MITRE ATT&CK v20.0 Enterprise with connected filters, a technique intelligence panel, detection strategies, and D3FEND 1.6.0 mappings.

Does ATT&CK Intelligence View include interactive tutorials?

Yes. 11 guided tutorials run on the live matrix: Matrix Overview, Detection Engineering, Threat Actor Mapping, Framework Gap Analysis, Two-Sheet Comparison, Data Source Mapping, Threat Hunting, System Hardening, Technology-Specific Technique, Sigma Rule Lookup, and ATT&CK Version Switching. Open Tutorial in the matrix header or visit the matrix with ?tutorial in the URL.

How is it different from the MITRE ATT&CK® Navigator?

The MITRE ATT&CK® Navigator focuses on layer scoring and coverage heatmaps. ATT&CK Intelligence View adds live filters, detection engineering content, role-based tutorials, and multi-sheet Excel export in one workflow.

Where should I start in the guide?

Start an interactive tutorial from the guide hub or matrix header, then read Getting Started and Matrix & Filters. Tutorial tracks: Matrix Overview, Detection Engineering, Threat Actor Mapping, Framework Gap Analysis, Two-Sheet Comparison, Data Source Mapping, Threat Hunting, System Hardening, Technology-Specific Technique, Sigma Rule Lookup, or ATT&CK Version Switching. Written guides also cover incident response, SOC & use cases framework gaps, threat hunting, system hardening, and purple team & adversary emulation.

Guide | ATT&CK Intelligence View Guide

ATT&CK Intelligence View guide hub: 11 interactive tutorials, getting started, incident response, detection engineering, two-sheet comparison, SOC framework gaps, threat hunting, and exports with View report and A4 PDF.

Getting Started — What ATT&CK Intelligence View is, who it is for, and how to take your first pass through the matrix. (6 min)
MITRE ATT&CK Navigator is Outdated! — Why the official MITRE ATT&CK Navigator layer workflow falls short for modern detection engineering—and what ATT&CK Intelligence View adds instead. (8 min)
Matrix & Filters — All six matrix filters in recommended order—what each represents, how to use it, examples, and common combinations. (14 min)
Technique Intelligence Panel — Deep dive into every tab in the technique side panel: Overview through Mitigations. (10 min)
Detection Engineering — End-to-end workflow: technique → detection strategy → analytic → telemetry → tunable parameters. (12 min)
Data Source Mapping — Map log sources—Sysmon, EDR telemetry, Windows Event Logs, CloudTrail, and more—to detectable ATT&CK v20.0 techniques and tactic categories. (10 min)
Mutable Elements — How MITRE analytic parameters work and how to read the Parameter / Explanation table in the Detections tab. (8 min)
ATT&CK v20.0 + D3FEND 1.6.0 — Connect offensive techniques to defensive countermeasures and artifact-based filtering. (7 min)
System Hardening With D3FEND 1.6.0 — Use MITRE D3FEND 1.6.0 mappings and ATT&CK v20.0 mitigations to plan preventive controls against specific techniques. (9 min)
Export & Layers — JSON layers, Excel exports, PNG matrix images, Compare TIDs with Current Filter, Compare Two TID Sheets, View report, and A4 PDF comparison exports. (12 min)
Incident Response — Use ATT&CK Intelligence View during active incidents: pivot from an observed TTP to context, related actors, mitigations, and telemetry quickly. (10 min)
Threat Intelligence — Groups, software, campaigns, threat-actor filtering, and threat modeling workflows. (10 min)
Threat Hunting — Hypothesis-driven hunts scoped with matrix filters, data components, and detection telemetry from each technique. (9 min)
Two-Sheet TID Comparison — Compare two standalone TID lists (detection catalog vs BAS executed, red team vs blue team, quarter-over-quarter)—with dummy workbook, interactive tutorial, View report, and A4 PDF export. (10 min)
SOC & Use Cases Framework Gaps — Compare SIEM alert TIDs and your use cases framework inventory against the ATT&CK matrix—View report, Framework Gap PDF, two-sheet BAS comparison, and platform-scoped gap analysis. (12 min)
Purple Team & Adversary Emulation — Pair ATT&CK v20.0 techniques with D3FEND 1.6.0 for tabletop exercises, map against detections, and identify coverage gaps systematically. (11 min)
Glossary — Quick reference for tactics, techniques, data components, detections, and D3FEND 1.6.0 terms. (5 min)
Changelog — Feature and functional fix updates for ATT&CK Intelligence View by release date. (4 min)