Your files stay on your device

MITRE ATT&CK coverage heatmap

Turn Sigma rules, coverage CSVs or Navigator layers into a color-coded heatmap of ATT&CK Enterprise coverage and gaps.

Add evidence and press Build heatmap. The samples show the CSV shape and a Sigma multi-document paste on real technique IDs.

A tagged rule is not a working detection. The heatmap maps where your rule set and coverage lists claim detections so you know where to test first; it never runs a rule against a log. The bundled matrix is ATT&CK Enterprise v 20.0 (released 2026-10-13), a snapshot rather than a live registry, and percentages count parent techniques only, with parents showing the best level of their sub-techniques.
OptionsBuild heatmap

More network tools

- CloudTrail analyzer (/network/aws-cloudtrail-log-analyzer)
- Port reference (/network/ports)
All network tools (/network)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/network/mitre-attack-coverage-heatmap
Markdown version: https://nutter.tools/network/mitre-attack-coverage-heatmap.md
Plain-text version: https://nutter.tools/network/mitre-attack-coverage-heatmap.txt
Agent index: https://nutter.tools/llms.txt