Lion Cipher Lab
Explore the MITRE ATT&CK Navigator
- Threat Intel Analyst
- Beginner
- ~35 min
- Free · no account required
Why it matters
Reading ATT&CK one technique at a time is fine for a single incident, but defenders have to reason about hundreds of techniques and dozens of adversaries at once. The Navigator is the free, official tool that turns that sprawl into a picture: colour in the techniques a threat group uses, colour in what your team can actually detect, and the gaps jump out as blank or red cells on a shared map instead of a vague worry that 'we might be missing something.' That single move — from prose to a prioritised, exportable picture of coverage — is how blue teams and threat-intel analysts decide where to…
What you'll learn
- what the MITRE ATT&CK Navigator is and when to reach for it
- creating an ATT&CK layer in the browser
- highlighting the techniques a named threat group uses
- scoring and colouring cells to show detection coverage gaps
- exporting a layer to share or reuse
- reading coverage as a picture to prioritise defence
Steps in this lab
- What ATT&CK and the Navigator are (the vocabulary in one place)
- Open the Navigator (hosted, or run it locally)
- Get to know the layer you just created
- Pick a real threat group from its ATT&CK page
- Highlight every technique that group uses
- Score cells to show your detection coverage gaps
- Export the layer so it can be shared and reused
- The honest part: paper coverage is not proven detection