The MITRE ATT&CK Dashboard is a powerful tool designed to provide rich insights into tactics, techniques, and sub-techniques across OffSec’s platform. This article will guide you through the dashboard’s core features, detail user access, and share key information to help you effectively navigate and leverage its capabilities.
General Information
The dashboard is accessible to enterprise clients seeking to visualize skill and detection gaps using the industry-standard MITRE ATT&CK framework. It operates as a coverage heatmap, tracking progress solely based on completed hands-on labs mapped to MITRE tactics, techniques, and sub-techniques. Reading modules, topic labs, and videos are excluded from the calculation.
By translating the complex landscape of cyber threats into an interactive visual format, the tool empowers users to identify where defensive skills or detection mechanisms may be lacking.
Who can view the Mitre Attack Dashboard?
All Enterprise Admins (Full Enterprise Admins, Sub-admins, Flex Admins, Admins with individual licenses).
What you can expect to see in the Dashboard
You will see the following:
- All the Mitre Tactics
- Heatmap
- The techniques and sub-techniques for each tactics
- The colored tile based on the learner’s progress
- Legend and tool tips as a guide that explains the meaning of colors and Coverage Calculation
- Filtering options
Which version of Mitre Attack can we see in the Dashboard?
The current mapped version for the Mitre Attack dashboard is version 16.1 so there might be techniques or sub-techniques not visible from the version 17.1. However, we are working on mapping the 17.1 version in the dashboard.
You are also able to see the Mitre Version by clicking on the (!) button next to Mitre Attack.
Where can I find the dashboard?
As an Admin, you can find the dashboard:
- Go to “Reports” menu on the left side navigation.
- From there, you will see the “Mitre Attack” tab.
- Click on the Mitre Attack tab and the dashboard is now visible
What is the Tile Color Legend?
The color of each tile on the MITRE Dashboard reflects the progress status for that specific technique or sub-technique:
GRAY: No labs are mapped to this technique or sub-technique.
WHITE: Labs are mapped, but no learners have started them.
LIGHT GREEN: Some progress has been made; 1 to 2 learners have achieved this technique or sub-technique.
DARK GREEN: All learners have achieved this technique or sub-technique.
What’s Included in Coverage Calculation?
Coverage is based only on the following lab types:
- Challenge labs – Task-based scenarios to apply skills.
- OCR labs – Offensive Cyber Range labs.
- DCR labs – Defensive Cyber Range labs
- PG Play labs – Play environments for practice.
- PG Practice labs – Guided practice labs.
These labs are where the system records hands-on completion data that contributes to a learner’s progress or coverage metrics.
Admin Filtering Option
We’re introducing filtering and drill-down options to give users clearer insights into progress and coverage across techniques and sub-techniques.
- Users: Narrow results by individual users or groups (where applicable).
- Coverage: Easily see techniques based on their coverage status.
- Achieved In: Filter techniques and sub-techniques by the date they were completed.
- Show All Content: Toggle this option to display all techniques and sub-techniques, whether they’re linked to labs or not.
Additionally, when you click on any technique or subtechnique tile, a modal will open with two tabs:
- Progress – Displays which users have made progress.
- Labs – Shows the labs mapped to that specific technique or subtechnique.
These updates are designed to provide greater transparency into skill coverage and make it easier to connect techniques with relevant labs.
Who can have their progress recorded on the dashboard?
Progress is tracked for all users who had access during the reporting period, including Admins, as long as their activity falls within the covered time interval.
How is progress recorded?
Progress is based on the number of labs completed and number of labs mapped.
- If there are 5 or more labs mapped, the learner must complete at least 5 to be marked as Achieved.
- If there are fewer than 5 labs mapped (but more than 1), the learner must complete all of them to be marked as Achieved.
How often does the dashboard update?
The dashboard reflects current active learners with access and updates daily (every 24 hours).
NOTE: When a license expires, is reassigned, or terminated, if a learner’s access falls within the time interval displayed on the dashboard, their count and progress remains unchanged.
Can I download the Mitre Attack Dashboard report?
As of the moment, there is no option to download the dashboard as a report.