Navigator, STIX/TAXII, and ATT&CK Data Model
The Navigator, STIX/TAXII, and ATT&CK Data Model domain tests the tooling and data plumbing behind ATT&CK. ATT&CK Navigator is a web application for viewing and annotating matrices. A layer is a JSON file that stores technique selections, scores, colors, comments, filters, and metadata. Layers can be imported and exported and shared, but they do not modify ATT&CK itself. Navigator supports Enterprise, Mobile, and ICS matrices and can hide or show sub-techniques, platforms, and disabled techniques. Use layers for gap analysis, detection coverage, and red-team planning, and version them alongside the ATT&CK release they reference.
STIX and TAXII
ATT&CK is distributed as STIX 2.x data. Relevant STIX objects include attack-pattern (techniques), malware and tool (software), intrusion-set (groups), campaign, course-of-action (mitigations), and x-mitre-data-source plus relationships. TAXII 2.x is a transport protocol for sharing CTI collections; it is not the data format. A TAXII server can serve ATT&CK bundles, but consumers still need to parse STIX relationships and marking definitions.
Worked example
A team builds a Navigator layer containing techniques with detections. They export the layer JSON, store it in Git with the ATT&CK version, and share the underlying STIX bundle through a TAXII collection. A consumer queries the collection, parses attack-pattern objects and their relationship objects, and joins them to the layer by technique ID. If the layer uses a parent ID but the bundle uses a sub-technique ID, the join will miss unless normalized.
Traps
Confusing TAXII with STIX is common. Do not assume a Navigator layer is a live feed or an authoritative coverage record. Do not ignore revoked or deprecated objects. Do not treat a TAXII collection as a single JSON file; it is a protocol endpoint with collections and objects.