feat: export MITRE ATT&CK Navigator coverage layer for deployed stack

CHANGELOG.md

@@ -5,6 +5,7 @@ All notable changes to soc-stack are documented in this file. Format follows [Ke
 ## [Unreleased]
 
 ### Added
+- ATT&CK Navigator coverage layer export: `scripts/lib/navigator.sh` + declarative map in `scripts/lib/data/attack-coverage.json`, written after install to `--navigator-out` (default `/root/soc-stack-navigator.json`); offline regenerator `tools/export-navigator-layer.sh`. Only deployed components and successfully integrated links contribute techniques.
 - README adoption pass: prominent website link, live CI and release badges, a keyword-rich "What it does" section, a redacted result-JSON example block, and "Why not something else?" / "What soc-stack is not" sections
 - `CODE_OF_CONDUCT.md` (Contributor Covenant 2.1)
 - `.github/ISSUE_TEMPLATE/config.yml` (disables blank issues, routes security reports and questions off the issue tracker)

README.md

@@ -94,6 +94,7 @@ sudo bash install.sh --components all --dry-run   # validate + plan, deploy noth
 After install:
 - `/root/soc-stack.json` lists every component with its LXC VMID, IP, ports, endpoints, warnings, and secret file paths. Raw passwords and API tokens are redacted by default; pass `--include-secrets-json` only when an automation workflow explicitly needs them.
 - `/root/mcp-clients.json` is a paste-ready `mcpServers` config block for Claude Desktop, OpenClaw, or any MCP client. It contains bearer tokens and is written root-only.
+- `/root/soc-stack-navigator.json` is a MITRE ATT&CK Navigator layer describing declared detection coverage for deployed components and verified integrations. Import it at https://mitre-attack.github.io/attack-navigator/. Regenerate later with `tools/export-navigator-layer.sh` without redeploying.
 - `/var/lib/soc-stack/state/` has per-component state files used for idempotent re-runs.
 - `/var/lib/soc-stack/secrets/` has every generated credential (mode 0600, root-only) for audit recovery.
 
@@ -182,6 +183,7 @@ Designed so an AI agent can SSH into a Proxmox host and one-shot a SOC. The full
 --state-dir PATH      State directory (default: /var/lib/soc-stack)
 --json-out PATH       Result JSON path (default: /root/soc-stack.json)
 --mcp-config-out PATH MCP client config (default: /root/mcp-clients.json)
+--navigator-out PATH  ATT&CK Navigator coverage layer (default: /root/soc-stack-navigator.json)
 --log-file PATH       Install log (default: /var/log/soc-stack-install.log)
 --dry-run             Validate + plan only, no deploy
 --force               Redeploy components already marked deployed
@@ -200,15 +202,18 @@ soc-stack/
 ├── install.sh                  # repo-root wrapper for curl|bash
 ├── scripts/
 │   ├── install.sh              # orchestrator (~430 lines)
-│   ├── lib/                    # 8 shared bash modules (bats-tested)
+│   ├── lib/                    # shared bash modules (bats-tested)
 │   │   ├── logging.sh
 │   │   ├── secrets.sh
 │   │   ├── json-out.sh
 │   │   ├── idempotency.sh
 │   │   ├── network.sh
 │   │   ├── manifest.sh
 │   │   ├── preflight.sh
-│   │   └── lxc.sh
+│   │   ├── lxc.sh
+│   │   ├── navigator.sh        # ATT&CK Navigator coverage layer emitter
+│   │   └── data/
+│   │       └── attack-coverage.json
 │   └── components/
 │       ├── wazuh/              # manifest.jsonc + 5 scripts per component
 │       ├── thehive-cortex/
@@ -217,13 +222,17 @@ soc-stack/
 │       ├── dashboards/
 │       └── mcp/                # 9 MCP servers + mcp-proxy SSE bridge
 ├── tests/
-│   ├── unit/                   # 105 bats tests, mocked Proxmox binaries
+│   ├── unit/                   # bats unit tests, mocked Proxmox binaries
 │   └── integration/            # per-component + cross-component assertions
 ├── docs/
 │   ├── design/specs/           # design spec (result JSON schema lives here)
 │   ├── gotchas.md
 │   ├── adding-a-component.md   # component contract walk-through
 │   └── architecture/
+├── tools/
+│   ├── export-navigator-layer.sh  # regenerate ATT&CK Navigator coverage from state
+│   ├── setup-ci-runner.sh
+│   └── soc-stack-test-reaper.sh
 ├── playbooks/                  # incident response playbooks
 ├── cases/                      # case study evidence
 └── mcp-servers/
@@ -286,7 +295,7 @@ This stops and destroys the component's LXC and removes its state file. Other co
 for comp in mcp dashboards zeek-suricata misp thehive-cortex wazuh; do
   sudo bash scripts/components/${comp}/destroy.sh
 done
-sudo rm -rf /var/lib/soc-stack /root/soc-stack.json /root/mcp-clients.json
+sudo rm -rf /var/lib/soc-stack /root/soc-stack.json /root/mcp-clients.json /root/soc-stack-navigator.json
 ```
 The final `rm` removes state, generated secrets, and the emitted JSON; skip it if you want credential recovery later.
 

scripts/install.sh

@@ -38,6 +38,8 @@ OPT_STATE_DIR="/var/lib/soc-stack"
 OPT_JSON_OUT="/root/soc-stack.json"
 # shellcheck disable=SC2034
 OPT_MCP_CONFIG_OUT="/root/mcp-clients.json"
+# shellcheck disable=SC2034
+OPT_NAVIGATOR_OUT="/root/soc-stack-navigator.json"
 OPT_LOG_FILE="/var/log/soc-stack-install.log"
 # shellcheck disable=SC2034
 OPT_DRY_RUN="0"
@@ -72,6 +74,7 @@ Flags:
   --state-dir PATH      State directory (default: /var/lib/soc-stack)
   --json-out PATH       Result JSON (default: /root/soc-stack.json)
   --mcp-config-out PATH MCP client config (default: /root/mcp-clients.json)
+  --navigator-out PATH  ATT&CK Navigator coverage layer (default: /root/soc-stack-navigator.json)
   --log-file PATH       Log file (default: /var/log/soc-stack-install.log)
   --dry-run             Validate + plan, do not deploy
   --force               Redeploy even if state shows complete
@@ -89,7 +92,7 @@ parse_args() {
   local flag
   while [[ $# -gt 0 ]]; do
     case "$1" in
-      --components|--preset|--bridge|--storage|--ip-mode|--ip-range|--vlan|--vmid-start|--manifest|--state-dir|--json-out|--mcp-config-out|--log-file|--mcp-bind-host)
+      --components|--preset|--bridge|--storage|--ip-mode|--ip-range|--vlan|--vmid-start|--manifest|--state-dir|--json-out|--mcp-config-out|--navigator-out|--log-file|--mcp-bind-host)
         flag="$1"
         if [[ $# -lt 2 || "$2" == --* ]]; then
           printf 'missing value for %s\n' "${flag}" >&2
@@ -109,6 +112,7 @@ parse_args() {
           --state-dir)      OPT_STATE_DIR="$2" ;;
           --json-out)       OPT_JSON_OUT="$2" ;;
           --mcp-config-out) OPT_MCP_CONFIG_OUT="$2" ;;
+          --navigator-out)  OPT_NAVIGATOR_OUT="$2" ;;
           --log-file)       OPT_LOG_FILE="$2" ;;
           --mcp-bind-host)  OPT_MCP_BIND_HOST="$2" ;;
         esac
@@ -254,6 +258,7 @@ source_libs() {
   source "${LIB_DIR}/preflight.sh"
   source "${LIB_DIR}/lxc.sh"
   source "${LIB_DIR}/manifest.sh"
+  source "${LIB_DIR}/navigator.sh"
 }
 
 # Known components in canonical order
@@ -769,6 +774,11 @@ main() {
   emit_mcp_config "${OPT_MCP_CONFIG_OUT}"
   msg_ok "MCP client config written to ${OPT_MCP_CONFIG_OUT}"
 
+  if [[ -n "${OPT_NAVIGATOR_OUT}" ]]; then
+    emit_navigator_layer "${OPT_NAVIGATOR_OUT}"
+    msg_ok "ATT&CK Navigator layer written to ${OPT_NAVIGATOR_OUT}"
+  fi
+
   return "${exit_status}"
 }
 

scripts/lib/data/attack-coverage.json

@@ -0,0 +1,122 @@
+{
+  "version": "1.0",
+  "domain": "enterprise-attack",
+  "attack_version": "17",
+  "navigator_version": "5.1.0",
+  "layer_version": "4.5",
+  "name": "SOC Stack Detection Coverage",
+  "description": "Declared detection coverage for the installed soc-stack components and verified integrations. Score is the number of contributing sources. Only deployed components and successfully integrated links contribute.",
+  "components": {
+    "wazuh": {
+      "display_name": "Wazuh",
+      "techniques": [
+        { "id": "T1003", "comment": "Credential dumping detection via rules and FIM" },
+        { "id": "T1021", "comment": "Remote services / lateral movement alerting" },
+        { "id": "T1036", "comment": "Masquerading and anomalous process naming" },
+        { "id": "T1041", "comment": "Suspicious outbound / exfil patterns in logs" },
+        { "id": "T1053", "comment": "Scheduled task and cron monitoring" },
+        { "id": "T1055", "comment": "Process injection indicators" },
+        { "id": "T1059", "comment": "Command and scripting interpreter execution" },
+        { "id": "T1070", "comment": "Indicator removal / log clearing" },
+        { "id": "T1078", "comment": "Valid account misuse and auth anomalies" },
+        { "id": "T1082", "comment": "System information discovery" },
+        { "id": "T1105", "comment": "Ingress tool transfer" },
+        { "id": "T1110", "comment": "Brute force authentication" },
+        { "id": "T1190", "comment": "Exploit of public-facing application" },
+        { "id": "T1486", "comment": "Ransomware / destructive file activity" },
+        { "id": "T1547", "comment": "Boot or logon autostart persistence" },
+        { "id": "T1548", "comment": "Abuse elevation control mechanism" },
+        { "id": "T1562", "comment": "Defense impairment (agent/service stop)" },
+        { "id": "T1566", "comment": "Phishing-related mail and endpoint signals" }
+      ]
+    },
+    "zeek-suricata": {
+      "display_name": "Zeek + Suricata",
+      "techniques": [
+        { "id": "T1018", "comment": "Remote system discovery via connection metadata" },
+        { "id": "T1021", "comment": "Remote services observed in conn/ssh logs and IDS" },
+        { "id": "T1040", "comment": "Network sniffing / SPAN visibility via NSM" },
+        { "id": "T1041", "comment": "C2 and exfil over application protocols" },
+        { "id": "T1046", "comment": "Network service scanning" },
+        { "id": "T1048", "comment": "Exfiltration over alternative protocol" },
+        { "id": "T1071", "comment": "Application-layer protocol C2 (HTTP/DNS/TLS)" },
+        { "id": "T1095", "comment": "Non-application layer protocol traffic" },
+        { "id": "T1105", "comment": "Tool transfer over the wire (files.log / fileinfo)" },
+        { "id": "T1189", "comment": "Drive-by compromise signatures" },
+        { "id": "T1190", "comment": "Exploit attempts against public services" },
+        { "id": "T1203", "comment": "Client-side exploitation signatures" },
+        { "id": "T1498", "comment": "Network denial of service" },
+        { "id": "T1571", "comment": "Non-standard port usage" },
+        { "id": "T1573", "comment": "Encrypted channel anomalies (JA3/TLS)" },
+        { "id": "T1595", "comment": "Active scanning" }
+      ]
+    },
+    "misp": {
+      "display_name": "MISP",
+      "techniques": [
+        { "id": "T1071", "comment": "IOC correlation for known C2 infrastructure" },
+        { "id": "T1102", "comment": "Web service C2 indicators from threat feeds" },
+        { "id": "T1566", "comment": "Phishing IOCs (domains, URLs, hashes)" },
+        { "id": "T1583", "comment": "Acquired infrastructure tracking via feeds" },
+        { "id": "T1584", "comment": "Compromised infrastructure indicators" }
+      ]
+    },
+    "thehive-cortex": {
+      "display_name": "TheHive + Cortex",
+      "techniques": [
+        { "id": "T1041", "comment": "Observable enrichment for exfil/C2 indicators" },
+        { "id": "T1071", "comment": "Analyzer enrichment of network observables" },
+        { "id": "T1566", "comment": "Phishing case triage and observable analysis" }
+      ]
+    }
+  },
+  "integrations": {
+    "wazuh-thehive-webhook": {
+      "display_name": "Wazuh -> TheHive webhook",
+      "from": "wazuh",
+      "to": "thehive-cortex",
+      "type": "webhook",
+      "wired_by": "wazuh",
+      "techniques": [
+        { "id": "T1059", "comment": "Alert-to-case handoff for script execution detections" },
+        { "id": "T1078", "comment": "Alert-to-case handoff for account misuse" },
+        { "id": "T1486", "comment": "Alert-to-case handoff for destructive activity" }
+      ]
+    },
+    "thehive-cortex-api": {
+      "display_name": "TheHive <-> Cortex API",
+      "from": "thehive-cortex",
+      "to": "thehive-cortex",
+      "type": "api",
+      "wired_by": "thehive-cortex",
+      "techniques": [
+        { "id": "T1071", "comment": "Automated analyzer enrichment on case observables" },
+        { "id": "T1566", "comment": "Phishing observable fan-out to Cortex analyzers" }
+      ]
+    },
+    "misp-suricata-rule-feed": {
+      "display_name": "MISP -> Suricata rule feed",
+      "from": "misp",
+      "to": "zeek-suricata",
+      "type": "rule-feed",
+      "wired_by": "zeek-suricata",
+      "techniques": [
+        { "id": "T1071", "comment": "IOC-derived Suricata rules for known C2" },
+        { "id": "T1102", "comment": "IOC-derived rules for web-service C2" },
+        { "id": "T1566", "comment": "IOC-derived rules for phishing infrastructure" }
+      ]
+    },
+    "zeek-wazuh-agent-forward": {
+      "display_name": "Zeek -> Wazuh agent forward",
+      "from": "zeek-suricata",
+      "to": "wazuh",
+      "type": "agent-forward",
+      "wired_by": "zeek-suricata",
+      "techniques": [
+        { "id": "T1046", "comment": "NSM scan evidence correlated in SIEM" },
+        { "id": "T1071", "comment": "NSM protocol metadata correlated in SIEM" },
+        { "id": "T1105", "comment": "NSM file-transfer evidence correlated in SIEM" }
+      ]
+    }
+  }
+}