Feature request: "one-click" layer upgrade

[NettleSec]

Hello everyone, and thank you for the great work you are doing with Navigator - it is an amazing tool! Nevertheless, I do have a request related to a "twice-a-year issue" connected with its use...

Since I (and - I assume - a lot of other people) use Navigator layers as a way to document detection coverage, threat models etc. in various environments/for various systems, it means that if I want these materials to stay up-to-date, I need to upgrade them every time a new version of ATT&CK is published. However, the current upgrade process is really not suited to upgrading layers containing hundred or more annotated (sub-)techniques (not to mention upgrading multiple such layers at a time). I would therefore like to ask if it would be possible to add an option for a "simplified upgrade", which would automatically copy all annotations on all techniques, which were "just" updated in between ATT&CK versions, and only asked for explicit user input for those techniques where, for example, mapping to tactics has changed, or where two techniques were merged between ATT&CK versions.

Since this would make the upgrade process manageable even for complexly annotated layers made with old ATT&CK versions, I'm sure it would save significant amounts of work to many people like me... And - as a bonus - it would make sensor mappings and similar MITRE/Engenuity projects made with older ATT&CK versions much more useful given that one could upgrade the mappings layers made for ATT&CK v8 to v15 (or v16) with just a few clicks, instead with few hundred, which would be realistically required today.

[TurnipPotato]

I agree with this. We are having to do this regularly. The process of updating is slow and many of my team have made mistakes by clicking next, rather than clicking on the arrows to go to the next 10 in the list. Met with up to 400 changes for some layers, this makes tasks laborious and de-incentives upgrading ATT&CK layers.

[clemiller]

Thanks for sharing your thoughts and feedback on the layer upgrade process. I understand that upgrading layers in Navigator can be a time-consuming and tedious task, especially when working with heavily annotated layers or managing many layers at once. The idea of a simplified upgrade feature is definitely interesting and would make the process smoother.

There are a couple things we'd need to consider before implementing a "one-click" workflow like this:

• Handling technique changes: techniques that have been merged, split, or have their tactic mappings updated would still need user input to make sure the annotations stay accurate. We'd need a reliable way to flag these cases without missing anything important.
• Annotation accuracy: automatically copying annotations can be tricky. Navigator already does this in cases where the technique scope hasn't changed (techniques in the minor changes and unchanged sections of the layer upgrade interface), but for other cases, there's risk of missing subtle changes in technique definitions or scope. We'd want to make sure users still have some control over how their annotations are applied in those cases.

If you have additional thoughts on how this could work, please let us know! Any input on what an ideal simplified upgrade workflow would look like and what could make the process more intuitive/helpful would be valuable as we think of ways to improve this feature.

We'll keep this issue open to continue gathering feedback/ideas.

[NettleSec]

Thank you for your response. Regarding the concern around major technique changes, I believe that, in most cases, the rationale for annotating a specific technique is unlikely to change significantly, even when a technique is updated. However, I understand that this may not always be the case, and some users may have more nuanced use cases where the context and meaning of an annotation could shift.

To balance this, a reasonable middle ground could be to introduce a "semi-automatic" upgrade option, as I originally suggested, which would copy annotations for all techniques that haven't been split, merged, or altered in terms of tactic mapping. To address the potential for reduced accuracy, this feature could include a clear warning before use, highlighting the risk of missed context changes and allowing the user to make an informed decision. This would give users the flexibility to choose the upgrade path that best fits their specific needs, without overwhelming them with manual updates.

Meanwhile, for techniques that have undergone significant structural changes (spliting, merging, etc.), the current manual review approach could remain in place, ensuring that critical annotations are not unintentionally misapplied. I'd be happy to share more detailed ideas if that would be helpful.