Run a scheduled job that pulls the latest STIX bundle from MITRE, parses techniques and relationships into your sheet schema, and queues new and revised entries for review. New techniques appear as rows; existing techniques update through diff-aware ingest; the corpus stays within one quarter of upstream without manual full re-imports.

Yes. Add a siem_rules JSON object keyed by SIEM product (splunk, sentinel, elastic) with values pointing to rule IDs or content-pack URLs. A selector renders a Detection coverage block on each technique page. Defenders see canonical MITRE guidance alongside concrete detection identifiers from the team's actual SIEM deployment.

Each sub-technique gets its own row with a parent_technique column carrying the parent slug. The base template renders breadcrumbs and parent-child navigation on every page. T1059.001 (PowerShell) becomes /threat/attack/t1059-001-powershell/ with a clear visible link back to T1059. The taxonomy stays browseable both top-down and bottom-up.

Yes. Add a purple_team_results JSON object with date, exercise name, detection outcome, and remediation status. A list mapping renders a Purple team history block on each technique page. Defenders see the team's actual detection history per technique alongside canonical MITRE guidance, surfacing gaps and trends over time.

Add an apt_activity_recent column populated by a scheduled job from your threat-intel feed. The base template renders a Recent observed activity block when populated. Each technique page surfaces current activity by named groups without requiring editorial work; the threat-intel feed itself drives freshness through scheduled ingests.

Add a matrix column with values like enterprise, ics, mobile, cloud. The same template handles every matrix because the entity shape is the same; matrix-specific blocks (industrial-control telemetry on ICS pages, mobile-OS-specific platforms on Mobile pages) render through conditional Twig in the base template. One sheet drives all matrices.

Yes when paired with sitemap submission, internal linking from tactic landing pages, and reasonable page-load performance. ATT&CK technique IDs are well-known query strings and pages with proper structured data tend to rank well for technique-ID and technique-name searches. Authority builds through internal cross-references between techniques, tactics, mitigations, and groups.

Yes. Add a sensitivity column. Conditional Twig in the base template hides detection-rule IDs and purple-team specifics for unauthenticated visitors while showing them to authenticated SOC users. The same row drives both views with rendered HTML differing only by the requesting user's role in the WordPress permission system.