Atomic-Red-Team-Visualizer

A tool to convert MITRE ATT&CK Navigator visual layers to Atomic Red Team playbooks for APT simulation and atomic testing visibility

Why ARTV?

If you've ever tried to build an Atomic Red Team Playbook for the Invoke-AtomicRunner command, you know the struggle: constantly switching between your text editor and Red Canary's atomic test index, only to discover the technique you wanted to test doesn't even have a corresponding atomic test.

Now imagine trying to create a playbook for APT emulation:

1. Find (or build) an ATT&CK Navigator layer mapping out the group's known techniques.
2. Go through each technique in the layer, cross referencing each one against Red Canary's Atomic Red Team index to see if a test exists for your platform.
3. Write down Note down the matching test GUIDs, names, and technique IDs - and repeat for every sub-technique.
4. Assemble everything into a playbook CSV, in the correct tactic order, while keeping track of techniques with no available test at all.
5. Start over from the beginning whenever MITRE updates the STIX data or Red Canary adds new atomic tests.

ARTV automates that workflow. Point it at a STIX bundle and an Atomic Red Team index once to build a mappings file, then feed it any colored Navigator layer to get a ready-to-run playbook in seconds.

Installation and Usage

Requirements

• Python 3.14 (might work on earlier versions have not tested)
• Atomic Red Team Visualizer (ARTV) does not require any Python dependencies.

Installation

• ARTV is a single Python script so installation is very straightforward, simply download the script from GitHub.

  • wget https://raw.githubusercontent.com/agrevster/atomic-red-team-visualizer/refs/heads/master/artv.py

Usage

ARTV has two subcommands: create-mappings and layer-to-playbook. Run python artv.py --help or python artv.py <subcommand> --help at any time for the full option list.

create-mappings

Builds a mappings JSON file linking MITRE ATT&CK techniques/tactics to their available Atomic Red Team tests for a given platform. You'll typically only need to regenerate this when MITRE ATT&CK or Atomic Red Team publish updates.

You can find the latest version of the MITRE ATT&CK STIX JSON here, and the latest Atomic Red Team Indexes here. It is recommended to only create an atomic playbook for one platform at a time. Use the index file {platform name}-index.csv from the link above, and ensure the --supported-platform flag matches the Platform/OS name in the CSV.

Flag	Required	Description
--mitre-stix	Yes	Path to the MITRE ATT&CK STIX JSON file (enterprise-attack.json)
--atomic-indexes	Yes	Path to the Atomic Red Team indexes CSV for the target platform
--supported-platform	Yes	Platform/OS name; should match the name used in the index CSV
--output	Yes	Path to write the generated mappings JSON file

python artv.py create-mappings \
  --mitre-stix enterprise-attack.json \
  --atomic-indexes windows-index.csv \
  --supported-platform windows \
  --output mappings.json

layer-to-playbook

Converts a MITRE ATT&CK Navigator layer file into an Atomic Red Team Playbook CSV, using the mappings file from the previous command. Only techniques colored with one of the --color values you specify are included.

Note

Only the enterprise-attack domain is supported.

Flag	Required	Default	Description
--output	Yes	—	Path to write the generated Atomic Red Team Playbook CSV
--mappings	Yes	—	Path to the mappings JSON produced by create-mappings
--layer	Yes	—	Path to the input MITRE ATT&CK Navigator layer JSON
--color	Yes	—	Hex color of techniques to include; repeat the flag for multiple colors
--timeout-seconds	No	30	Seconds to wait before an Atomic Red Team test times out
--ignore-non-compatible-test-logs	No	off	Suppresses log messages for techniques with no matching Atomic Red Team test
--give-me-all-the-tests	No	off	Includes every available test for each matched technique automatically, skipping the per-test confirmation prompt

python artv.py layer-to-playbook \
  --output playbook.csv \
  --mappings mappings.json \
  --layer my-navigator-layer.json \
  --color "#e60d0d" \
  --color "#f9a825"

By default, ARTV prompts you to confirm (y/n) each Atomic Red Team test before adding it to the playbook. Pass --give-me-all-the-tests to skip these prompts and include every matching test automatically — this can add a lot of tests, so use with care.

Testing

• ARTV comes bundled with some basic Python integration tests to ensure it remains compatible with the latest versions of Atomic Red Team, MITRE ATT&CK STIX and MITRE ATT&CK Visualizer.
• To run the tests use the following command:

python -m unittest artv.py

• This will create a test_data directory in the CWD where the files used to test the CLI will be stored.

Note

This will download the following files from GitHub onto your PC. This could take some time depending on your connection speed.

Files:

• https://raw.githubusercontent.com/redcanaryco/atomic-red-team/refs/heads/master/atomics/Indexes/Indexes-CSV/windows-index.csv
• https://raw.githubusercontent.com/mitre-attack/attack-stix-data/refs/heads/master/enterprise-attack/enterprise-attack.json