Add Phase 2 ATT&CK Navigator layer export endpoint and dashboard integration

- app.py: GET /api/navigator-layer maps current alert categories to MITRE
  technique IDs (brute_force→T1110.001, port_scan→T1046, malware→T1059,
  phishing→T1566, anomaly→T1078) and returns a Navigator 4.9 layer JSON
  scored by highest observed alert severity
- dashboard.html: "Export ATT&CK Layer" button right-aligned in the
  quick-filter row
- dashboard.js: downloadNavigatorLayer() fetches the layer and triggers
  a browser file download as navigator_layer.json
- 18 new tests covering auth boundary, JSON structure, all fixture
  category→technique mappings, and per-severity scores

Author: Romil2112

app.py

@@ -187,6 +187,23 @@ def load_user(user_id):
 # Severity ordering used for queue sorting (CRITICAL first).
 SEVERITY_RANK = {"CRITICAL": 1, "HIGH": 2, "MEDIUM": 3, "LOW": 4}
 
+# ATT&CK Navigator: map SOC alert categories to MITRE technique IDs.
+_CATEGORY_MITRE: dict[str, str] = {
+    "brute_force": "T1110.001",
+    "port_scan":   "T1046",
+    "malware":     "T1059",
+    "phishing":    "T1566",
+    "anomaly":     "T1078",
+}
+
+# Score used in the Navigator layer; higher severity → higher heat.
+_NAVIGATOR_SCORE: dict[str, int] = {
+    "CRITICAL": 100,
+    "HIGH":      75,
+    "MEDIUM":    50,
+    "LOW":       25,
+}
+
 # Map a classify action to the resulting alert status.
 ACTION_TO_STATUS = {
     "classify_tp": "true_positive",
@@ -848,6 +865,68 @@ def api_add_note(alert_id):
     return jsonify({"id": row["id"], "created_at": row["created_at"].isoformat()}), 201
 
 
+# --------------------------------------------------------------------------- #
+# ATT&CK Navigator layer export
+# --------------------------------------------------------------------------- #
+@app.route("/api/navigator-layer")
+@login_required
+def api_navigator_layer():
+    """Return the current alert corpus as an ATT&CK Navigator 4.9 layer JSON.
+
+    Groups alerts by category → MITRE technique, scoring each entry by the
+    highest observed severity. The JSON can be imported directly at
+    https://mitre-attack.github.io/attack-navigator/.
+    """
+    with get_conn() as conn, conn.cursor() as cur:
+        cur.execute(
+            "SELECT category, severity, count(*) AS c "
+            "FROM alerts GROUP BY category, severity"
+        )
+        rows = cur.fetchall()
+
+    techniques: dict[str, dict] = {}
+    total = 0
+    for row in rows:
+        cat   = row["category"]
+        sev   = row["severity"]
+        count = row["c"]
+        total += count
+        tid   = _CATEGORY_MITRE.get(cat)
+        if not tid:
+            continue
+        score = _NAVIGATOR_SCORE.get(sev, 25)
+        if tid not in techniques or score > techniques[tid]["score"]:
+            techniques[tid] = {
+                "techniqueID": tid,
+                "score":       score,
+                "color":       "",
+                "comment":     f"{cat}: {count} alert(s), {sev}",
+                "enabled":     True,
+            }
+
+    layer = {
+        "name": "SOC Dashboard Alert Coverage",
+        "versions": {"attack": "14", "navigator": "4.9", "layer": "4.5"},
+        "domain": "enterprise-attack",
+        "description": f"ATT&CK coverage derived from {total} SOC alert(s).",
+        "techniques": list(techniques.values()),
+        "gradient": {
+            "colors":   ["#ffd700", "#ff6600", "#cc0000"],
+            "minValue": 0,
+            "maxValue": 100,
+        },
+        "legendItems": [
+            {"label": "CRITICAL (100)", "color": "#cc0000"},
+            {"label": "HIGH (75)",      "color": "#ff6600"},
+            {"label": "MEDIUM (50)",    "color": "#ffd700"},
+            {"label": "LOW (25)",       "color": "#33cc66"},
+        ],
+        "showTacticRowBackground":      False,
+        "selectTechniquesAcrossTactics": True,
+    }
+    return jsonify(layer)
+
+
 # --------------------------------------------------------------------------- #
 # Server-Sent Events
 # --------------------------------------------------------------------------- #

static/dashboard.js

@@ -407,6 +407,20 @@ function initSSE() {
   };
 }
 
+// ----- ATT&CK Navigator export --------------------------------------------- //
+function downloadNavigatorLayer() {
+  fetch("/api/navigator-layer")
+    .then(r => r.blob())
+    .then(blob => {
+      const url = URL.createObjectURL(blob);
+      const a   = document.createElement("a");
+      a.href     = url;
+      a.download = "navigator_layer.json";
+      a.click();
+      URL.revokeObjectURL(url);
+    });
+}
+
 // ----- boot ---------------------------------------------------------------- //
 document.addEventListener("DOMContentLoaded", () => {
   initAnalystInput();

templates/dashboard.html

@@ -56,13 +56,14 @@
   </div>
 </div>
 
-<!-- Quick filter presets -->
+<!-- Quick filter presets + export controls -->
 <div class="d-flex flex-wrap gap-2 mb-3" id="preset-buttons">
   <span class="text-secondary small align-self-center me-1">Quick filters:</span>
   <button class="btn btn-sm btn-outline-info"      onclick="applyPreset('my-queue')">My Queue</button>
   <button class="btn btn-sm btn-outline-danger"    onclick="applyPreset('critical-today')">Critical Today</button>
   <button class="btn btn-sm btn-outline-warning"   onclick="applyPreset('escalated')">Escalated</button>
   <button class="btn btn-sm btn-outline-secondary" onclick="applyPreset('all-open')">All Open</button>
+  <button class="btn btn-sm btn-outline-light ms-auto" onclick="downloadNavigatorLayer()" title="Export ATT&amp;CK Navigator layer JSON">Export ATT&amp;CK Layer</button>
 </div>
 
 <!-- Filter bar: drives the charts and the alert queue below -->

tests/test_navigator.py

@@ -0,0 +1,114 @@
+"""Tests for GET /api/navigator-layer.
+
+Uses the same `client` and `anon_client` fixtures from conftest.py.
+The FIXTURES data (4 alerts: brute_force/CRITICAL, malware/CRITICAL,
+anomaly/LOW, phishing/HIGH) drives all assertions about technique IDs and scores.
+"""
+import json
+
+
+def test_navigator_layer_requires_auth(anon_client):
+    rv = anon_client.get("/api/navigator-layer")
+    assert rv.status_code in (401, 302)
+
+
+def test_navigator_layer_authenticated_returns_200(client):
+    rv = client.get("/api/navigator-layer")
+    assert rv.status_code == 200
+
+
+def test_navigator_layer_content_type_json(client):
+    rv = client.get("/api/navigator-layer")
+    assert rv.content_type.startswith("application/json")
+
+
+def test_navigator_layer_domain(client):
+    data = client.get("/api/navigator-layer").get_json()
+    assert data["domain"] == "enterprise-attack"
+
+
+def test_navigator_layer_version_fields(client):
+    data = client.get("/api/navigator-layer").get_json()
+    assert data["versions"]["layer"]     == "4.5"
+    assert data["versions"]["navigator"] == "4.9"
+    assert data["versions"]["attack"]    == "14"
+
+
+def test_navigator_layer_has_techniques_list(client):
+    data = client.get("/api/navigator-layer").get_json()
+    assert isinstance(data["techniques"], list)
+
+
+def test_navigator_layer_brute_force_maps_to_t1110(client):
+    data     = client.get("/api/navigator-layer").get_json()
+    ids      = {t["techniqueID"] for t in data["techniques"]}
+    assert "T1110.001" in ids
+
+
+def test_navigator_layer_brute_force_critical_scores_100(client):
+    data = client.get("/api/navigator-layer").get_json()
+    bf   = next(t for t in data["techniques"] if t["techniqueID"] == "T1110.001")
+    assert bf["score"] == 100
+
+
+def test_navigator_layer_phishing_maps_to_t1566(client):
+    data = client.get("/api/navigator-layer").get_json()
+    ids  = {t["techniqueID"] for t in data["techniques"]}
+    assert "T1566" in ids
+
+
+def test_navigator_layer_phishing_high_scores_75(client):
+    data    = client.get("/api/navigator-layer").get_json()
+    phish   = next(t for t in data["techniques"] if t["techniqueID"] == "T1566")
+    assert phish["score"] == 75
+
+
+def test_navigator_layer_anomaly_maps_to_t1078(client):
+    data = client.get("/api/navigator-layer").get_json()
+    ids  = {t["techniqueID"] for t in data["techniques"]}
+    assert "T1078" in ids
+
+
+def test_navigator_layer_anomaly_low_scores_25(client):
+    data   = client.get("/api/navigator-layer").get_json()
+    anomly = next(t for t in data["techniques"] if t["techniqueID"] == "T1078")
+    assert anomly["score"] == 25
+
+
+def test_navigator_layer_malware_maps_to_t1059(client):
+    data = client.get("/api/navigator-layer").get_json()
+    ids  = {t["techniqueID"] for t in data["techniques"]}
+    assert "T1059" in ids
+
+
+def test_navigator_layer_technique_has_required_keys(client):
+    data = client.get("/api/navigator-layer").get_json()
+    for t in data["techniques"]:
+        assert "techniqueID" in t
+        assert "score"       in t
+        assert "enabled"     in t
+        assert "comment"     in t
+
+
+def test_navigator_layer_has_gradient(client):
+    data = client.get("/api/navigator-layer").get_json()
+    g    = data["gradient"]
+    assert g["minValue"] == 0
+    assert g["maxValue"] == 100
+
+
+def test_navigator_layer_has_legend_items(client):
+    data = client.get("/api/navigator-layer").get_json()
+    assert len(data["legendItems"]) == 4
+
+
+def test_navigator_layer_description_mentions_alert_count(client):
+    data = client.get("/api/navigator-layer").get_json()
+    # 4 alerts in fixtures
+    assert "4" in data["description"]
+
+
+def test_navigator_layer_no_duplicate_technique_ids(client):
+    data = client.get("/api/navigator-layer").get_json()
+    ids  = [t["techniqueID"] for t in data["techniques"]]
+    assert len(ids) == len(set(ids))