MLASTG → MITRE ATLAS Coverage Mapping¶

Overview¶

This directory contains the complete mapping between the MLASTG framework (MLASVS controls + MLASTG test cases) and MITRE ATLAS™ adversarial techniques. All technique IDs are verified against the official MITRE ATLAS taxonomy.

Deliverables¶

File	Format	Purpose
Coverage Matrix	Markdown table	Every ATLAS technique mapped to MLASVS controls with coverage rating
Navigator Layer	JSON (Navigator format)	Import into MITRE ATLAS Navigator for visual heat map
Gap Analysis	Markdown	Unprotected attack paths needing new controls
Coverage Dashboard	Markdown	Summary statistics, coverage %, key findings

Coverage Rating System¶

Rating	Meaning	Color	Criteria
Full	Fully covered	🟢 Green	L1 + L2 controls exist with test cases
Partial	Partially covered	🟡 Yellow	L1 controls exist, L2 or tests missing
None	No coverage	🔴 Red	No MLASVS control for this attack path

Coverage Summary¶

Metric	Value
Total ATLAS techniques mapped	27 technique IDs in Navigator layer
🟢 Full coverage	17 (63%)
🟡 Partial coverage	10 (37%)
🔴 No coverage	1 (ML Model Inventory Discovery — no official ATLAS ID)
Unique MLASVS controls	64 of 168 (38% coverage density)
ATLAS Navigator techniques	27 technique IDs with scores

ATLAS Navigator Import¶

To visualize coverage in the MITRE ATLAS Navigator: 1. Download 2-atlas-navigator-layer.json 2. Open the MITRE ATLAS Navigator (use the ATLAS-specific tool, not the ATT&CK Navigator) 3. Click Open Existing Layer → Upload from local → select the downloaded JSON file 4. Coverage will appear as a heat map (green = full, yellow = partial, red = none)

Notes¶

Only official MITRE ATLAS technique IDs are included. Attack paths without official IDs use "—" and are tracked in the Gap Analysis.
Tactic-level mappings (AML.TA####) indicate general coverage across techniques under that tactic.
Sub-techniques (e.g., AML.T0020.001 for Label Poisoning) are counted separately.