STIX versioning appears to be broken across all current versions of the ATT&CK JSON #20
Comments
|
I don't think this has always been this way. The last ATT&CK JSON I worked with extensively was either 8 or 9, and I'm fairly certain that at the time STIX versioning was working. It looks like the various versions of the JSON have been regenerated/modified, and I no longer have access to reference copies to compare. While this isn't necessarily workflow breaking, it does seem that there is a mix of properly versioned & non-versioned objects intermingled, and some of these objects might or might not have a x_mitre meta versioning. It's a bit confusing and frustrating. |
|
Taking a look at version 1.0 of the ATT&CK JSON, I get the impression that the "created" time is when the technique was created, not when the STIX object was created. For example: id, created, modified According to the STIX spec, Either way - there are 188 objects in ATT&CK json version 1.0 that imply versioning but don't have requisite properties. |
|
There are 188 attack patterns in ATT&CK 1.0 that aren't using STIX 2.1 versioning properly. There are 188 attack patterns in ATT&CK 2.0 that aren't using STIX 2.1 versioning properly. There are 219 attack patterns in ATT&CK 3.0 that aren't using STIX 2.1 versioning properly. There are 244 attack patterns in ATT&CK 4.0 that aren't using STIX 2.1 versioning properly. There are 244 attack patterns in ATT&CK 5.0 that aren't using STIX 2.1 versioning properly. There are 266 attack patterns in ATT&CK 6.0 that aren't using STIX 2.1 versioning properly. There are 574 attack patterns in ATT&CK 10.0 that aren't using STIX 2.1 versioning properly. There are 422 attack patterns in ATT&CK 11.2 that aren't using STIX 2.1 versioning properly. |
agfoster
changed the title
I believe STIX versioning isn't properly implemented/applied to whatever is generating the current ATT&CK JSON.
From section
3.6 Versioningof the STIX 2.1 spec:There are 422 attack-patterns in the current JSON that have non-matching creation/modification times and are missing the required
revokedproperty. There are 297 attack-patterns that do have therevokedproperty. The first attack-pattern (['objects'][1]) in the is an example of an object that is clearly versioned, but doesn't have the requisite properties.attack-pattern--0042a9f5-f053-4769-b3ef-9ad018dfa298 is versioned but missing 'revoked':
created: 2020-01-14T17:18:32.126Z
modified 2022-04-25T14:00:00.188Z
['objects'][1].keys()
['x_mitre_platforms', 'x_mitre_domains', 'object_marking_refs', 'id', 'type', 'created', 'created_by_ref', 'external_references', 'modified', 'name', 'description', 'kill_chain_phases', 'x_mitre_detection', 'x_mitre_is_subtechnique', 'x_mitre_version', 'x_mitre_modified_by_ref', 'x_mitre_data_sources', 'x_mitre_defense_bypassed', 'spec_version', 'x_mitre_attack_spec_version']The text was updated successfully, but these errors were encountered: