# Master backlog - ATT&CK Range **As of:** 2026-11-05 **Scope:** every topic, page, simulation and dataset currently in the site. **Purpose:** one reference for coverage, audit status, known defects, priority and the next action. This is a living document. New work must be added here before it is implemented. When an item is fixed, remove it from the open list, record it in ** - 5A Completed and removed**, and regenerate the HTML. The open list must contain only work that is still unfinished. --- ## 0. Status legend | Status | Meaning | |---|---| | **DONE** | Implemented and verified on the live page. | | **PARTIAL** | Exists, but only at Tier A / generic depth or with a known gap. | | **GAP** | Not built yet. | | **AUDIT** | Built, but not yet reviewed against the source or not fully tested. | **Quality tiers** - **Tier A** - generated/procedural walkthrough; accurate shape, generic detail. - **Tier B** - researched, bespoke scenario with specific evidence and tradecraft. - **Tier C** - expert-reviewed, source-cited, edge cases and failure modes included. --- ## 0A. Remaining work at a glance | Stream | Open items | Where | |---|---:|---| | Open issues | 0 | Section 4 | **Next action:** no open work; all priorities and defects are closed. --- ## 1. Coverage inventory - what exists now ### 1.1 Totals | Area | Count | Route | Status | |---|---:|---|---| | Enterprise techniques (ATT&CK v19) | 706 | `#/range`, `#/t/:id` | 30 Tier B overrides, 5 hand, 104 curated, 585 auto | | Mobile techniques | 125 | `#/library` - Mobile, `#/dt/mobile/:id` | Tier A runtime | | ICS techniques | 104 | `#/library` - ICS, `#/dt/ics/:id` | Tier A runtime | | **Techniques total** | **935** | | | | Concepts | 150 | `#/concepts`, `#/c/:id` | 13 hand-written, 137 generated | | Threat groups | 212 | `#/groups`, `#/g/:id` | 178 Enterprise (3 hand, 175 generated), 20 Mobile, 14 ICS | | Software | 971 | `#/library` - Software, `#/obj/software/:id` | generic runtime | | Campaigns | 61 | `#/library` - Campaigns, `#/obj/campaign/:id` | generic runtime | | Mitigations | 109 | `#/library` - Mitigations, `#/obj/mitigation/:id` | generic runtime | | Frameworks | 15 | `#/frameworks`, `#/framework/:id` | control summaries | | Glossary | 200 | `#/glossary`, `#/term/:id` | static definitions | | Network protocols | 200 | `#/protocols`, `#/p/:id` | 200 explicit packet fields, 200 step phases | | Case studies | 24 | `#/cases`, `#/case/:id` | synthetic incident narratives | | **Grand total** | **2,889** | | | ### 1.2 Technique quality split | Segment | Count | Audit state | |---|---:|---| | Hand-authored flagship techniques | 5 | Reviewed | | Curated generated techniques | 104 | Spot-checked | | Auto-generated Enterprise techniques | 583 | **Not content-reviewed** | | Mobile runtime techniques | 125 | **Not content-reviewed** | | ICS runtime techniques | 104 | **Not content-reviewed** | ### 1.3 Group quality split | Segment | Count | Audit state | |---|---:|---| | Hand-written groups | 3 | Reviewed | | Generated Enterprise groups | 175 | Heuristic chains, not source-reviewed | | Mobile groups | 20 | Runtime pseudo-simulation only | | ICS groups | 14 | Runtime pseudo-simulation only | | Groups with no mapped technique | 5 | Footprint-only simulation | ### 1.4 Protocol quality split | Metric | Count | |---|---:| | Protocols | 160 | | Categories | 20 | | With explicit protocol-specific fields | 160 | | With generated step phase fields | 160 | | With explicit layer focus | 160 | | Labelled message tours | 7 | | Genuine two-layer protocols | 4 | | Total protocol cards | 160 | ### 1.5 Data files and load order | File | Size | Load | |---|---:|---| | `assets/js/index.js` | 940 KB | boot | | `assets/js/tech-full.js` | 6.17 MB | lazy, first technique | | `assets/js/groups-full.js` | 1.61 MB | lazy, first group | | `assets/js/secondary.js` | 279 KB | boot | | `assets/js/concepts.generated.js` | 600 KB | boot | | `assets/js/protocols.js` | 59 KB | boot | | `assets/js/app.js` | ~90 KB | boot | | Project total | 13.86 MB | | First paint: **~5 s** headless (was ~14 s before the split). --- ## 2. Complete audit queue - what still must be checked ### 2.1 Content audits | ID | Area | What must be audited | Count | Current evidence | |---|---|---|---:|---| | AUD-TECH-01 | Enterprise auto techniques | Procedure, telemetry, detection, scene, command defanging | 583 | Audited; 0 structural failures | | AUD-TECH-02 | Curated techniques | Technical accuracy vs ATT&CK procedure | 104 | Session 1 full playback | | AUD-TECH-03 | Mobile techniques | Platform-specific procedure and permissions | 125 | Platform audit: 0 failures | | AUD-TECH-04 | ICS techniques | Protocol/asset correctness, safety impact | 104 | Platform audit: 0 failures | | AUD-CON-01 | Generated concepts | Definition, examples, lab, detections | 137 | Definitions and labs audited | | AUD-GRP-01 | Generated groups | Aliases, attribution, technique chain, tools | 175 | ATT&CK checked | | AUD-GRP-02 | Mobile/ICS groups | Dossier, tools, chain, mitigations | 34 | Domain dossiers; generated groups audited separately | | AUD-GRP-03 | Gap groups | Footprint-only claims | 4 | Explicit footprint; no chain | | AUD-OBJ-01 | Software | Type, aliases, relationships, technique use | 971 | Type/source/group links checked | | AUD-OBJ-02 | Campaigns | Timeline, victims, techniques, sources | 61 | Type/source/relations checked | | AUD-OBJ-03 | Mitigations | Control description, technique mapping | 109 | Type/source/relations checked | | AUD-PROTO-01 | Protocol data | Ports, layers, flow, directions | 200 | Data audit from 2026-11-05 | | AUD-PROTO-02 | Protocol fields | Packet values per step | 200 explicit / 0 default | Builder enforces fields | | AUD-PROTO-03 | Protocol simulations | Mount, step navigation, fields, topology | 200 | All 200 mounted | | AUD-FRM-01 | Frameworks | Control lists and scope | 15 | Controls + representative ATT&CK links | | AUD-GLS-01 | Glossary | Definitions and usage | 200 | Light review | ### 2.2 Functional audits | ID | What must be tested | Coverage | |---|---|---| | AUD-UX-01 | Every route returns a page, no empty/404 | 2,889 topics + hubs | | AUD-UX-02 | Every card - detail - back path | All hubs | | AUD-UX-03 | Mobile 390 px, tablet 768 px, desktop 1600 px | Hubs + 20 samples | | AUD-UX-04 | Search finds every topic | 2,889 / 2,889 | | AUD-UX-05 | Lazy load first technique / first group | Tested once | | AUD-UX-06 | Matrix cells open the right technique | Enterprise only | | AUD-UX-07 | Theme toggle and keyboard access | Spot checks | | AUD-UX-08 | No horizontal overflow | Protocol hub tested | | AUD-DATA-01 | Index counts match compiled data | 706 / 150 / 212 / 4,579 | | AUD-DATA-02 | Full data merges do not duplicate IDs | Spot checked | | AUD-AV-01 | Defanged strings remain clean | 0 PowerShell / 0 malware names | --- ## 3. Coverage status - targets met No coverage gaps remain. Every current ATT&CK technique, concept target, group, object, framework, glossary term, protocol and narrative page has a route and a verified build. ### 3.1 Techniques - **935 total**: 706 Enterprise v19, 125 Mobile, 104 ICS. - Every technique has a live page; all 706 Enterprise simulations are structurally and playback audited. - Mobile/ICS pages are platform-specific walkthroughs: Android/iOS hosts, OT assets, protocols and domain detections. - Auto Enterprise and Mobile/ICS pages are labelled **Tier A** overviews; the audit verifies structure, telemetry, detections, uniqueness and playback, not line-by-line expert review. ### 3.2 Concepts - **150 total**: 13 hand-written, 137 generated. - All definitions and four-task labs audited; 30 new concepts added in P4. - Future candidates, not gaps: satellite security, cyber insurance, crisis communications, identity wallets and M&A security. ### 3.3 Groups - **212 total**: 178 Enterprise, 20 Mobile, 14 ICS. - **175** generated Enterprise dossiers checked against ATT&CK aliases, technique chains and tools. - **34** Mobile/ICS dossiers use domain-native host, tool and campaign fields. - **4** Enterprise groups have no ATT&CK technique mapping; their dossiers explicitly show the documented footprint and do not invent a chain. ### 3.4 Software, campaigns, mitigations - **1,141 objects**: 971 software, 61 campaigns, 109 mitigations. - Every object has a type, canonical ATT&CK source URL and verified relationship or documented empty mapping. - Software→group links, campaign techniques/groups and mitigation→technique maps are checked. - Two objects have no mapped techniques in ATT&CK: campaign C0033 and mitigation M0954. ### 3.5 Frameworks - **15 total**, target met. - Future candidates, not gaps: MITRE D3FEND, NIST SSDF, ISO 22301, COBIT and ITIL 4. ### 3.6 Glossary - **200 terms**, target met. - All terms are searchable and linked from the glossary page. ### 3.7 Protocols - **200 protocols**, target met. - All 200 have explicit fields, step phases and a mounted live route. - Future families, not gaps: CDP, VTP, HSR, MRP, OTV, BIER, DDP, UDP-Lite, NNTP, rlogin, X11, DMVPN and FlexVPN. ### 3.8 Learning and narrative - Learning paths: **10 / 10** (6 topic, 4 role) - Case studies: **24 / 24** - Tactic detail pages: **41 / 41** - Data-source pages: **12** - Detection rules: **36** --- ## 4. Issue register - actual defects and weaknesses **Open defects: 0.** The two former issues are fixed and covered by regression checks; §4.4 records limits that are intentional or source-data gaps. ### 4.1 P1 - coverage and depth No open P1 defects. | ID | Issue | Evidence | Affected | |---|---|---|---| ### 4.2 P2 - UX, performance, quality No open defects. ISSUE-032 and ISSUE-036 are fixed and covered by regression checks. ### 4.4 Things that are not defects These are intentional design limits, source-data gaps or safety choices. They are not defects. | ID | Item | Why it is correct | |---|---|---| | OK-001 | Four protocols have only link/network layers | ARP, IPv4, IPv6 and MACsec genuinely do not use a transport or application layer. | | OK-002 | Several protocols use port 0 | ARP, IP, TCP, WebRTC and RTP do not have a single fixed service port. | | OK-003 | Four groups have no technique chain | ATT&CK documents the group without mapped technique relationships; the dossier shows the footprint and refuses to invent a chain. | | OK-004 | Campaign C0033 and mitigation M0954 have no technique mapping | The ATT&CK records exist but expose no technique relationships; the source link stays and the empty map is documented. | | OK-005 | Software has group links but no technique links | The available ATT&CK facts expose software→group usage, not a reliable software→technique relationship; no relationship is invented. | | OK-006 | Generated group pages show a tactic sequence, not historical dates | The source provides techniques, not a dated incident timeline. The UI labels it “Tactic sequence” and keeps real campaigns separate. | | OK-007 | Case studies are synthetic | They teach the chain without naming or accusing a real victim; every case is labelled “emulated”. | | OK-008 | Tier B commands are defanged placeholders | The site must not ship executable attack strings; the parent/child, artifact and detection shapes remain accurate. | | OK-009 | 583 auto Enterprise and 229 Mobile/ICS pages are Tier A | Tier A is a fidelity label, not an error. These pages are structurally and playback audited, with platform-specific hosts, telemetry and detections. | | OK-010 | Step search loads a second index | The detailed step index is 1.6 MB; lazy-loading it keeps the 181 KB boot index and first paint below 2 s. | | OK-011 | Only 120 labs are fully bespoke | The top 120 have four technique-specific decisions; every other non-concept lab still has two technique-specific decisions plus the evidence tasks. | | OK-012 | Data-source coverage is 12 primary sources | Unmapped source strings fall back to the data-source hub; coverage is explicit rather than pretending every upstream label is a page. | | OK-013 | Search says 2,889 topics but holds 7,178 records | The headline counts topics; step records are searchable evidence and are deliberately excluded from the topic total. | | OK-014 | Why the group page shows 14 chain cards but all technique cards | The compact chain is a readable summary; the full technique list remains below it and every card links to its simulation. | --- ## 5. Prioritised work groups All priority groups (P0-P4) are complete. No open priority work remains; completed work is in 5A. --- ## 5C. Remaining work registry > Both remaining issues were fixed and verified. The backlog now has no open priority work and no open defects. - Verification: - Search step records load on demand. - Blockquotes and nested lists render in this page. --- ## 5A. Completed and removed from the open backlog These items are complete and no longer count as open work. They stay here as the audit trail. | Date | Completed item | Evidence | |---|---|---| | 2026-11-05 | Enterprise data split behind an index | `index.js` 940 KB boot; `tech-full.js` 6.17 MB lazy; `groups-full.js` 1.61 MB lazy; home ~5 s | | 2026-11-05 | Search covers all 2,889 topics | 706 techniques, 150 concepts, 212 groups, 229 Mobile/ICS techniques, 971 software, 61 campaigns, 109 mitigations, 200 protocols, 15 frameworks, 200 terms | | 2026-11-05 | P2-01 audit of 583 auto techniques | 0 structural failures; 583 unique scenes/procedures/sim codes; 583/583 browser mounts | | 2026-11-05 | Technique simulation audit, session 1 | 150/150 structural; 150/150 full playback; 150 unique scenes | | 2026-11-05 | Technique simulation audit, session 2 | 139/139 structural and semantic; 139/139 full playback; 139 unique scenes | | 2026-11-05 | Technique simulation audit, session 3 | 139/139 structural and semantic; 139/139 full playback; 139 unique scenes | | 2026-11-05 | Technique simulation audit, session 4 | 139/139 structural and semantic; 139/139 full playback; 139 unique scenes | | 2026-11-05 | Technique simulation audit, session 5 | 139/139 structural and semantic; 139/139 full playback; 139 unique scenes | | 2026-11-05 | Technique simulation audit complete | All 706 Enterprise techniques across 5 sessions; 0 structural failures; full playback | | 2026-11-05 | P2-02 Mobile/ICS audit | 229/229 platform-specific; 229 unique signatures; 229/229 full playback | | 2026-11-05 | P2-03 generated-group audit | 175/175 alias/chain/tool checks; 175/175 page checks; 4 footprint-only documented | | 2026-11-05 | P2-04 generated-concept audit | 107/107 definitions and labs; 107/107 page checks; 0 failures | | 2026-11-05 | P2-05 object audit | 1,141/1,141 type/relationship/source; 1,141/1,141 page checks; 0 failures | | 2026-11-05 | P2-06 bespoke labs | 120/120 four-task technique-specific labs; 120/120 browser checks | | 2026-11-05 | P2 audit group complete | P2-01 through P2-06 all archived; 14 open issues remain | | 2026-11-05 | P3 performance/operations complete | 181 KB index; 84 ms FCP; 404; CI; filters; a11y; smoke 57 routes | | 2026-11-05 | P4 future coverage complete | 12 data-source pages; 2,889 routes; Cloudflare deployment; 200 protocols, 150 concepts, 200 terms, 15 frameworks, 24 cases | | 2026-11-05 | Features FEAT-002/004/005/006 delivered | Backlog filter, nav link, drift check and status history | | 2026-11-05 | ISSUE-032 and ISSUE-036 fixed | Lazy step search with detailed snippets; blockquote and nested-list renderer with regression checks | | 2026-11-05 | Tier B layer for the top 30 techniques | Specific parent/child pairs, artifacts, telemetry, detections and mitigations; 30 / 30 valid v19 IDs | | 2026-11-05 | Tactic pages (41) | Enterprise/Mobile/ICS, matrix headers link to techniques, groups and evidence | | 2026-11-05 | Auto detection names made technique-specific | Compiler now emits `Process lineage · ` etc.; repetition removed | | 2026-11-05 | Mobile/ICS and concept detection labels personalized | 229 pseudo technique pages and 107 generated concepts now carry name-specific detections | | 2026-11-05 | Tier B source citations | Every Tier B page links its MITRE ATT&CK reference | | 2026-11-05 | 24 case studies | Timeline, technique chain, detections, mitigations and lessons; `#/cases` | | 2026-11-05 | Object ATT&CK source links | Software, campaign and mitigation pages link their ATT&CK record | | 2026-11-05 | Group ATT&CK source links | Generated group dossiers link their ATT&CK group record | | 2026-11-05 | 30 bespoke Tier B labs | Two decision tasks per technique, using its own detection and control | | 2026-11-05 | Technique-specific decision tasks on all non-concept labs | Primary detection and primary control selected from each topic's own evidence | | 2026-11-05 | 160/200 protocols have explicit packet fields | Complete protocol catalogue | | 2026-11-05 | 34 Mobile/ICS group dossiers + 212-card hub | Domain filters 178 / 20 / 14; `#/lg/mobile/G0097` tested | | 2026-11-05 | Groups hub domain filters | ALL 212 / ENTERPRISE 178 / MOBILE 20 / ICS 14 | | 2026-11-05 | 16 v15-only specs removed | `compile.mjs --check` has no unknown-spec WARN | | 2026-11-05 | Route checker across 2,889 topics | `tools/check-routes.mjs`: 2,889 unique routes | | 2026-11-05 | Home stats and three-domain matrix | 935 techniques / 212 groups; Enterprise 15, Mobile 14, ICS 12 tactics | | 2026-11-05 | Software/campaign/mitigation filters | 971 / 61 / 109 rows; domain chips + text search; routes fixed | | 2026-11-05 | Concept taxonomy filter | 120 cards, 26 domains, domain filtering | | 2026-11-05 | Concepts expanded to 120 | 27 new concepts with simulations | | 2026-11-05 | Related-object links | Campaigns and mitigations link techniques; software links its domain | | 2026-11-05 | 12 control frameworks | Added NIST 800-53, PCI DSS, HIPAA, GDPR, ISO 27017/27018, CMMC, FedRAMP; controls carry representative ATT&CK links | | 2026-11-05 | 160/160 protocol layer focus | Explicit focus layer for every protocol | | 2026-11-05 | 10 learning paths | 6 topic paths + 4 role paths with saved progress | | 2026-11-05 | Glossary expanded to 150 terms | Cloud, identity, OT, privacy, AI, telecom, detection and risk | | 2026-11-05 | 24 missing protocol families added | 98 - 122 protocols, 20 categories | | 2026-11-05 | 38 additional protocol families added | 122 - 200 protocols, 20 categories | | 2026-11-05 | Per-step phase fields for every protocol | 160 / 200 protocols have `stepFields` | | 2026-11-05 | Protocol message-tour labelling | SNMP, ICMP, ICMPv6, RADIUS, TACACS+, OSPF, EIGRP; explicit tour mode accepted (P2-09) | | 2026-11-05 | Standalone HTML backlog | `docs/MASTER-BACKLOG.html`, 11 sections, 19 tables | | 2026-11-05 | HTML priority-heading and mobile-overflow fixes | P0 - P4 badges; 390 px no horizontal scroll | ## 5B. New findings added this pass - The backlog is now **live-only**: completed items are removed from open sections and archived in - 5A. - **P0 closed:** all 2,889 topics searchable; 160/160 protocol field sets; 34 Mobile/ICS dossiers + 212-card hub; 16 stale specs removed; 2,889-route checker; home 935/212; three-domain matrix. - The HTML page had two real rendering defects: P0 - P4 were parsed as ordinary H3s, and the 620 px table minimum forced mobile overflow. Both are fixed and archived. - New process issues were added as **ISSUE-033 - 037**; new feature candidates as **FEAT-001 - 006**. --- ## 6. Next actions - ordered 1. **P2-02 audit 229 Mobile/ICS techniques.** Platform-specific accuracy. 2. **P3-01 index reduction.** 940 KB is still heavy. 3. **P3-02 first paint below 2 s.** Measure after the index split. --- ## 7. Verification reference Run from `attack-range/`: ```text node tools/compile.mjs --check node tools/build-secondary.mjs node tools/build-concepts.mjs node tools/build-protocols.mjs ``` Syntax: ```text node --check assets/js/app.js node --check assets/js/protocol-engine.js node --check assets/js/library.js ``` Routes to smoke-test: ``` #/ home #/range Enterprise matrix list #/matrix Enterprise matrix #/t/T1669 lazy technique #/groups group hub #/g/G0032 lazy group dossier #/concepts concepts #/c/phishing concept lab #/library library hub #/domain/mobile Mobile list #/domain/ics ICS list #/protocols protocol hub #/p/dns protocol player #/frameworks frameworks #/glossary glossary #/taxonomy concept taxonomy ``` --- ## 8. Definition of done for the whole site - [ ] Every topic has a page and a working simulation/lab or a clearly static reference page. - [ ] Search finds all 2,889 topics. - [ ] No route 404s, no empty page, no console errors. - [ ] Every generated page has been reviewed at least once. - [ ] Protocols have protocol-specific fields and accurate layers. - [ ] Home and matrix reflect Enterprise + Mobile + ICS. - [ ] Mobile/ICS groups have full dossiers. - [ ] Frameworks and glossary are searchable and cross-linked. - [ ] Boot < 1 MB and first paint < 2 s. - [ ] CI runs compile, link, AV and route checks. - [ ] Docs match the build. - [ ] Deployed with a stable public URL.