Almost working version

css/main.css

@@ -12,6 +12,21 @@ main {
   flex-wrap: nowrap;
 }
 
+#forkMe {
+  position:absolute;
+  top:1em;
+  right:0;
+  border:0;
+  transform: rotateY(0deg) rotate(45deg);
+}
+
+.tbat-menu {
+  width: 235px;
+}
+.tbat-menu-fixed {
+  position: fixed;
+}
+
 .main-window {
   width: 100%;
   min-height: 100vh;
@@ -34,6 +49,35 @@ main {
   margin-bottom: 1em;
 }
 
+@media print {
+  .flex-column, .vertical-divider {
+    display: none !important;
+  }
+}
+
+/*.report-ttp.grid,
+.report-mitigation.grid {
+  display: inline-block;
+  margin: 0.5em;
+  padding: 1em;
+  background-color: #dfdfdf3d;
+}*/
+
+.grid {
+  display: grid;
+  grid-template-areas: "a a a a";
+  gap: 10px;
+  grid-auto-rows: min-content;
+}
+
+#window-report h1,
+#window-report h2 {
+  margin-bottom: 1em;
+}
+#window-report h2 {
+  margin-top: 1em;
+}
+
 select.form-intent {
   min-width: 6.5em;
   max-width: 62em;
@@ -56,13 +100,18 @@ select.form-novelty {
 
 .grid-square {
   border: 1px solid black;
-  font-size: 1.5em;
+  font-size: 1.2em;
   font-weight: bolder;
 }
 
+.grid-square p {
+    display: inline-block;
+    padding: 0 0.35em;
+}
+
 .grid-container div {
   text-align: center;
-  padding: 1em;
+  padding: 0.6em;
 }
 
 .grid-container .intent {
@@ -155,10 +204,26 @@ select.form-novelty {
 
 .dropdown-toggle { outline: 0; }
 
+#window-threatactorlibrary button {
+  margin-right: 1em;
+}
+
+.aps-badge {
+  margin-left: 1em;
+}
+
+#actorModal select, .pad {
+  margin-bottom: 1em;
+}
+
 .nav-flush .nav-link {
   border-radius: 0;
 }
 
+.custom-file {
+  display: none;
+}
+
 .btn-toggle {
   display: inline-flex;
   align-items: center;

cti-generator/README.md

@@ -0,0 +1,5 @@
+# cti-generator
+Cyber Threat Intelligence Generator
+
+This python code gets the objects from [mitre/cti](https://github.com/mitre/cti)
+and creates JavaScript objects that tbat will use.

cti-generator/main.py

@@ -0,0 +1,150 @@
+import json
+import markdown
+
+from collections import OrderedDict
+from stix2 import FileSystemSource, Filter
+from stix2.utils import get_type_from_id
+
+
+def writefile(filename: str, data: dict):
+    with open(f"../cti/{filename}.json", "w", encoding="utf-8") as f:
+        json.dump(data, f, default=str)
+
+
+# create FileSystemSource
+fs_source = FileSystemSource("../../cti/enterprise-attack")
+
+rels = fs_source.query(Filter("type", "=", "relationship"))
+isets = fs_source.query(
+    [Filter("type", "=", "intrusion-set"), Filter("revoked", "=", False)]
+)
+aps = fs_source.query(
+    [Filter("type", "=", "attack-pattern"), Filter("revoked", "=", False)]
+)
+coas = fs_source.query(
+    [Filter("type", "=", "course-of-action"), Filter("revoked", "=", False)]
+)
+
+# Mitigations
+
+mitigations = {}
+for coa in coas:
+    mitigation = {}
+
+    if "x_mitre_deprecated" in coa and coa["x_mitre_deprecated"] == True:
+        continue
+
+    if "name" in coa:
+        mitigation["name"] = coa["name"]
+
+    if "description" in coa:
+        mitigation["description"] = coa["description"]
+
+    if "external_references" in coa:
+        for er in coa["external_references"]:
+            if er["source_name"] == "mitre-attack":
+                mitigation["link"] = er["url"]
+                mitigation["external_id"] = er["external_id"]
+                break
+
+    if "external_id" in mitigation:
+        mitigations[coa["id"].replace("course-of-action--", "")] = mitigation
+
+# exit()
+
+writefile("mitigations", mitigations)
+
+# Tactics, techniques and procedures
+
+ttps_external_ids = {}
+ttps = {}
+for ap in aps:
+    ttp = {}
+
+    if "x_mitre_deprecated" in ap and ap["x_mitre_deprecated"] == True:
+        continue
+
+    if "name" in ap:
+        ttp["name"] = ap["name"]
+
+    if "description" in ap:
+        ttp["description"] = ap["description"]
+
+    if "external_references" in ap:
+        for er in ap["external_references"]:
+            if er["source_name"] == "mitre-attack":
+                ttp["link"] = er["url"]
+                ttp["external_id"] = er["external_id"]
+                break
+
+    if "kill_chain_phases" in ap:
+        for kcp in ap["kill_chain_phases"]:
+            if kcp["kill_chain_name"] == "mitre-attack":
+                ttp["kill_chain_phase"] = kcp["phase_name"]
+                break
+
+    if "external_id" in ttp:
+        ttps[ttp["external_id"]] = ttp
+        ttps_external_ids[ap["id"]] = ttp["external_id"]
+
+    ttp["mitigations"] = []
+    for rel in rels:
+        if (
+            rel.source_ref.startswith("course-of-action")
+            and rel.target_ref.startswith("attack-pattern")
+            and rel.target_ref == ap["id"]
+        ):
+            ttp["mitigations"].append(rel.source_ref.replace("course-of-action--", ""))
+
+writefile("ttps", OrderedDict(sorted(ttps.items())))
+
+# Threat groups
+
+groups = {}
+for iset in isets:
+    z = {}
+
+    if "x_mitre_deprecated" in iset and iset["x_mitre_deprecated"] == True:
+        continue
+
+    for i in ["created", "modified", "description"]:
+        if i in iset:
+            if type(iset[i]) == str:
+                z[i] = markdown.markdown(iset[i])
+            else:
+                z[i] = iset[i]
+        else:
+            z[i] = None
+
+    if "aliases" in iset:
+        z["aliases"] = iset["aliases"]
+    else:
+        z["aliases"] = []
+
+    z["link"] = None
+    if "external_references" in iset:
+        for er in iset["external_references"]:
+            if er["source_name"] == "mitre-attack":
+                z["link"] = er["url"]
+                break
+
+    z["attack-patterns"] = []
+
+    for rel in rels:
+        if (
+            rel.source_ref.startswith("intrusion-set")
+            and rel.target_ref.startswith("attack-pattern")
+            and iset.id == rel.source_ref
+        ):
+            if rel.target_ref in ttps_external_ids:
+                z["attack-patterns"].append(ttps_external_ids[rel.target_ref])
+
+    groups[iset["name"]] = z
+
+writefile("groups", OrderedDict(sorted(groups.items())))
+
+# Debug
+
+print(len(groups))
+print(len(ttps))
+print(len(mitigations))

cti-generator/requirements.txt

@@ -0,0 +1,2 @@
+stix2==3.0.0
+markdown==3.3.4

cti/mitigations.json

@@ -0,0 +1 @@
+{"12241367-a8b7-49b4-b86e-2236901ba50c": {"name": "Network Intrusion Prevention", "description": "Use intrusion detection signatures to block traffic at network boundaries.", "link": "https://attack.mitre.org/mitigations/M1031", "external_id": "M1031"}, "15437c6d-b998-4a36-be41-4ace3d54d266": {"name": "Vulnerability Scanning", "description": "Vulnerability scanning is used to find potentially exploitable software vulnerabilities to remediate them.", "link": "https://attack.mitre.org/mitigations/M1016", "external_id": "M1016"}, "1dcaeb21-9348-42ea-950a-f842aaf1ae1f": {"name": "Limit Access to Resource Over Network", "description": "Prevent access to file shares, remote access to systems, unnecessary services. Mechanisms to limit access may include use of network concentrators, RDP gateways, etc.", "link": "https://attack.mitre.org/mitigations/M1035", "external_id": "M1035"}, "20a2baeb-98c2-4901-bad7-dc62d0a03dea": {"name": "Remote Data Storage", "description": "Use remote security log and sensitive file storage where access can be controlled better to prevent exposure of intrusion detection log data or sensitive information.", "link": "https://attack.mitre.org/mitigations/M1029", "external_id": "M1029"}, "20f6a9df-37c4-4e20-9e47-025983b1b39d": {"name": "Filter Network Traffic", "description": "Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic.", "link": "https://attack.mitre.org/mitigations/M1037", "external_id": "M1037"}, "21da4fd4-27ad-4e9c-b93d-0b9b14d02c96": {"name": "Restrict Web-Based Content", "description": "Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc.", "link": "https://attack.mitre.org/mitigations/M1021", "external_id": "M1021"}, "23843cff-f7b9-4659-a7b7-713ef347f547": {"name": "Limit Software Installation", "description": "Block users or groups from installing unapproved software.", "link": "https://attack.mitre.org/mitigations/M1033", "external_id": "M1033"}, "25dc1ce8-eb55-4333-ae30-a7cb4f5894a1": {"name": "Application Developer Guidance", "description": "This mitigation describes any guidance or training given to developers of applications to avoid introducing security weaknesses that an adversary may be able to take advantage of.", "link": "https://attack.mitre.org/mitigations/M1013", "external_id": "M1013"}, "2995bc22-2851-4345-ad19-4e7e295be264": {"name": "Limit Hardware Installation", "description": "Block users or groups from installing or using unapproved hardware on systems, including USB devices.", "link": "https://attack.mitre.org/mitigations/M1034", "external_id": "M1034"}, "2a4f6c11-a4a7-4cb9-b0ef-6ae1bb3a718a": {"name": "User Training", "description": "Train users to be aware of access or manipulation attempts by an adversary to reduce the risk of successful spearphishing, social engineering, and other techniques that involve user interaction.", "link": "https://attack.mitre.org/mitigations/M1017", "external_id": "M1017"}, "2c2ad92a-d710-41ab-a996-1db143bb4808": {"name": "User Account Control", "description": "Configure Windows User Account Control to mitigate risk of adversaries obtaining elevated process access.", "link": "https://attack.mitre.org/mitigations/M1052", "external_id": "M1052"}, "2f316f6c-ae42-44fe-adf8-150989e0f6d3": {"name": "Operating System Configuration", "description": "Make configuration changes related to the operating system or a common feature of the operating system that result in system hardening against techniques.", "link": "https://attack.mitre.org/mitigations/M1028", "external_id": "M1028"}, "3efe43d1-6f3f-4fcb-ab39-4a730971f70b": {"name": "Data Backup", "description": "Take and store data backups from end user systems and critical servers. Ensure backup and storage systems are hardened and kept separate from the corporate network to prevent compromise.", "link": "https://attack.mitre.org/mitigations/M1053", "external_id": "M1053"}, "47e0e9fe-96ce-4f65-8bb1-8be1feacb5db": {"name": "Execution Prevention", "description": "Block execution of code on a system through application control, and/or script blocking.", "link": "https://attack.mitre.org/mitigations/M1038", "external_id": "M1038"}, "49c06d54-9002-491d-9147-8efb537fbd26": {"name": "Credential Access Protection", "description": "Use capabilities to prevent successful credential access by adversaries; including blocking forms of credential dumping.", "link": "https://attack.mitre.org/mitigations/M1043", "external_id": "M1043"}, "590777b3-b475-4c7c-aaf8-f4a73b140312": {"name": "Code Signing", "description": "Enforce binary and application integrity with digital signature verification to prevent untrusted code from executing.", "link": "https://attack.mitre.org/mitigations/M1045", "external_id": "M1045"}, "609191bf-7d06-40e4-b1f8-9e11eb3ff8a6": {"name": "Environment Variable Permissions", "description": "Prevent modification of environment variables by unauthorized users and groups.", "link": "https://attack.mitre.org/mitigations/M1039", "external_id": "M1039"}, "72dade3e-1cba-4182-b3b3-a77ca52f02a1": {"name": "Privileged Process Integrity", "description": "Protect processes with high privileges that can be used to interact with critical system components through use of protected process light, anti-process injection defenses, or other process integrity enforcement measures.", "link": "https://attack.mitre.org/mitigations/M1025", "external_id": "M1025"}, "787fb64d-c87b-4ee5-a341-0ef17ec4c15c": {"name": "Do Not Mitigate", "description": "This category is to associate techniques that mitigation might increase risk of compromise and therefore mitigation is not recommended.", "link": "https://attack.mitre.org/mitigations/M1055", "external_id": "M1055"}, "78bb71be-92b4-46de-acd6-5f998fedf1cc": {"name": "Pre-compromise", "description": "This category is used for any applicable mitigation activities that apply to techniques occurring before an adversary gains Initial Access, such as Reconnaissance and Resource Development techniques.", "link": "https://attack.mitre.org/mitigations/M1056", "external_id": "M1056"}, "7bb5fae9-53ad-4424-866b-f0ea2a8b731d": {"name": "SSL/TLS Inspection", "description": "Break and inspect SSL/TLS sessions to look at encrypted web traffic for adversary activity.", "link": "https://attack.mitre.org/mitigations/M1020", "external_id": "M1020"}, "7da0387c-ba92-4553-b291-b636ee42b2eb": {"name": "Boot Integrity", "description": "Use secure methods to boot a system and verify the integrity of the operating system and loading mechanisms.", "link": "https://attack.mitre.org/mitigations/M1046", "external_id": "M1046"}, "86598de0-b347-4928-9eb0-0acbfc21908c": {"name": "Network Segmentation", "description": "Architect sections of the network to isolate critical systems, functions, or resources. Use physical and logical segmentation to prevent access to potentially sensitive systems and information. Use a DMZ to contain any internet-facing services that should not be exposed from the internal network. Configure separate virtual private cloud (VPC) instances to isolate critical cloud systems.", "link": "https://attack.mitre.org/mitigations/M1030", "external_id": "M1030"}, "874c0166-e407-45c2-a1d9-e4e3a6570fd8": {"name": "Threat Intelligence Program", "description": "A threat intelligence program helps an organization generate their own threat intelligence information and track trends to inform defensive priorities to mitigate risk.", "link": "https://attack.mitre.org/mitigations/M1019", "external_id": "M1019"}, "90c218c3-fbf8-4830-98a7-e8cfb7eaa485": {"name": "Password Policies", "description": "Set and enforce secure password policies for accounts.", "link": "https://attack.mitre.org/mitigations/M1027", "external_id": "M1027"}, "90f39ee1-d5a3-4aaa-9f28-3b42815b0d46": {"name": "Behavior Prevention on Endpoint", "description": "Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior.", "link": "https://attack.mitre.org/mitigations/M1040", "external_id": "M1040"}, "93e7968a-9074-4eac-8ae9-9f5200ec3317": {"name": "User Account Management", "description": "Manage the creation, modification, use, and permissions associated to user accounts.", "link": "https://attack.mitre.org/mitigations/M1018", "external_id": "M1018"}, "987988f0-cf86-4680-a875-2f6456ab2448": {"name": "Restrict File and Directory Permissions", "description": "Restrict access by setting directory and file permissions that are not specific to users or privileged accounts.", "link": "https://attack.mitre.org/mitigations/M1022", "external_id": "M1022"}, "9bb9e696-bff8-4ae1-9454-961fc7d91d5f": {"name": "Privileged Account Management", "description": "Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.", "link": "https://attack.mitre.org/mitigations/M1026", "external_id": "M1026"}, "a2c36a5d-4058-475e-8e77-fff75e50d3b9": {"name": "Restrict Registry Permissions", "description": "Restrict the ability to modify certain hives or keys in the Windows Registry.", "link": "https://attack.mitre.org/mitigations/M1024", "external_id": "M1024"}, "a6a47a06-08fc-4ec4-bdc3-20373375ebb9": {"name": "Antivirus/Antimalware", "description": "Use signatures or heuristics to detect malicious software.", "link": "https://attack.mitre.org/mitigations/M1049", "external_id": "M1049"}, "b045d015-6bed-4490-bd38-56b41ece59a0": {"name": "Multi-factor Authentication", "description": "Use two or more pieces of evidence to authenticate to a system; such as username and password in addition to a token from a physical smart card or token generator.", "link": "https://attack.mitre.org/mitigations/M1032", "external_id": "M1032"}, "b5dbb4c5-b0b1-40b1-80b6-e9e84ab90067": {"name": "Software Configuration", "description": "Implement configuration changes to software (other than the operating system) to mitigate security risks associated to how the software operates.", "link": "https://attack.mitre.org/mitigations/M1054", "external_id": "M1054"}, "b9f0c069-abbe-4a07-a245-2481219a1463": {"name": "Application Isolation and Sandboxing", "description": "Restrict execution of code to a virtual environment on or in transit to an endpoint system.", "link": "https://attack.mitre.org/mitigations/M1048", "external_id": "M1048"}, "cc2399fd-3cd3-4319-8d0a-fbd6420cdaf8": {"name": "Audit", "description": "Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.", "link": "https://attack.mitre.org/mitigations/M1047", "external_id": "M1047"}, "d2a24649-9694-4c97-9c62-ce7b270bf6a3": {"name": "Exploit Protection", "description": "Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring.", "link": "https://attack.mitre.org/mitigations/M1050", "external_id": "M1050"}, "e3388c78-2a8d-47c2-8422-c1398b324462": {"name": "Active Directory Configuration", "description": "Configure Active Directory to prevent use of certain techniques; use SID Filtering, etc.", "link": "https://attack.mitre.org/mitigations/M1015", "external_id": "M1015"}, "e5d930e9-775a-40ad-9bdb-b941d8dfe86b": {"name": "Update Software", "description": "Perform regular software updates to mitigate exploitation risk.", "link": "https://attack.mitre.org/mitigations/M1051", "external_id": "M1051"}, "e8242a33-481c-4891-af63-4cf3e4cf6aff": {"name": "Restrict Library Loading", "description": "Prevent abuse of library loading mechanisms in the operating system and software to load untrusted code by configuring appropriate library loading mechanisms and investigating potential vulnerable software.", "link": "https://attack.mitre.org/mitigations/M1044", "external_id": "M1044"}, "eb88d97c-32f1-40be-80f0-d61a4b0b4b31": {"name": "Disable or Remove Feature or Program", "description": "Remove or deny access to unnecessary and potentially vulnerable software to prevent abuse by adversaries.", "link": "https://attack.mitre.org/mitigations/M1042", "external_id": "M1042"}, "f9f9e6ef-bc0a-41ad-ba11-0924e5e84c4c": {"name": "Account Use Policies", "description": "Configure features related to account use like login attempt lockouts, specific login times, etc.", "link": "https://attack.mitre.org/mitigations/M1036", "external_id": "M1036"}, "feff9142-e8c2-46f4-842b-bd6fb3d41157": {"name": "Encrypt Sensitive Information", "description": "Protect sensitive information with strong encryption.", "link": "https://attack.mitre.org/mitigations/M1041", "external_id": "M1041"}}