Lion Cipher Lab
Compare two adversaries' TTPs with ATT&CK Navigator layers (Navigator, part 2)
- Threat Intel Analyst
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Highlighting one threat group in a tool is a party trick. The job of threat intelligence is comparison: which behaviours do the actors who target MY sector share, so I can build one detection that catches several of them, and where are the gaps my defences miss entirely? A Navigator overlap layer answers that in a single picture. It turns a wall of technique IDs from two different reports into a heatmap where the hottest cells are the behaviours you most need to detect. That is the difference between collecting intel and using it.
What you'll learn
- reading a real threat report's ATT&CK technique table and telling a technique from a sub-technique
- building a Navigator layer by hand from a published report — marking, scoring and colouring cells
- building a second actor's layer as a separate tab
- combining two layers with a score expression (a + b) to produce an overlap heatmap
- reading the overlap to find shared TTPs and your own detection gaps
- treating a layer as a hypothesis to be tested, not proof of what an actor did
Steps in this lab
- The five words, defined once with no gaps
- Open the Navigator — hosted, free, nothing to install
- Read a real report: the SolarWinds Compromise
- Build Layer A by hand — mark, score, colour
- Build Layer B — a second, DIFFERENT actor
- The payoff: combine the two layers with a + b
- Read the overlap — shared TTPs and your own gaps
- The honest part: a layer is a hypothesis, not proof