Your files stay on your device

# MITRE ATT&CK coverage heatmap

Turn Sigma rules, coverage CSVs or Navigator layers into a color-coded heatmap of ATT&CK Enterprise coverage and gaps.

Add evidence and press Build heatmap. The samples show the CSV shape and a Sigma multi-document paste on real technique IDs.

A tagged rule is not a working detection. The heatmap maps where your rule set and coverage lists claim detections so you know where to test first; it never runs a rule against a log. The bundled matrix is ATT&CK Enterprise v 20.0 (released 2026-10-13), a snapshot rather than a live registry, and percentages count parent techniques only, with parents showing the best level of their sub-techniques.
OptionsBuild heatmap

## More network tools

- [CloudTrail analyzer](/network/aws-cloudtrail-log-analyzer)
- [Port reference](/network/ports)
[All network tools](/network)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/network/mitre-attack-coverage-heatmap
Markdown version: https://nutter.tools/network/mitre-attack-coverage-heatmap.md
Plain-text version: https://nutter.tools/network/mitre-attack-coverage-heatmap.txt
Agent index: https://nutter.tools/llms.txt