Am!tt Is now DISARM

[cvandeplas]

https://github.com/DISARMFoundation/DISARMframeworks

[cvandeplas]

considering the differences evaluate if a migration or full new galaxy would be the best option. (and mark the old one as deprecated)

[adulau]

I would go for a new galaxy. I saw some events relying on the old ones.

[adulau]

Looking into it:

• https://github.com/VIGINUM-FR/DISARM-FR (there is a French translation too)
• https://github.com/DISARMFoundation/DISARMframeworks/blob/main/DISARM_MASTER_DATA/DISARM_FRAMEWORKS_MASTER.xlsx (DISARM master XLS)
• The STIX version seems to abuse the mitre-attack scheme with custom objects
• We should go for a new galaxy (or multiple ones) as there are now phases in addition to tactics

[adulau]

Asking if the XLS is the real MASTER DISARMFoundation/DISARMframeworks#22

[cvandeplas]

I had a look today and the nice generate_DISARM_pages library of DISARM made the job much easier.
Considering the script is dependend on the DISARM lib, I pushed a generate_DISARM_MISP_galaxy.py tool on their repo: DISARMFoundation/DISARMframeworks#23 . Also added a tools/gen_disarm.py script here pointing to the DISARM repo.

The current generate_DISARM_MISP_galaxy.py script currently only generates the techniques. Not yet the other components which could also be useful. (in separate galaxies/clusters)

Here is what it looks like in the MISP webui:

[cvandeplas]

Many more of the datamodels were generated.
I think we can close this issue now.