Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Load Mitre ATT&CK Data #18

Open
brettforbes opened this issue Apr 25, 2023 · 1 comment
Open

Load Mitre ATT&CK Data #18

brettforbes opened this issue Apr 25, 2023 · 1 comment
Assignees
Labels
critical enhancement New feature or request

Comments

@brettforbes
Copy link
Collaborator

brettforbes commented Apr 25, 2023

First get:

  1. Attack delete working Finalise add multi-protocol capability #8 Note: The collection must be deleted first, then all other objects, and finally the marking and identity are to be deleted
  2. Cyclical working Check add sub conditions (1. already exists, 2. cyclical, missing dependency) and document #6

Then add the loading of attack data to the typedb initialisation routine.

If ""ATT&CK"=True" in the import_types config object then:

  1. Load the Attack schema
  2. Load the Attack data based on the "ATT&CK_Versions" and "ATT&CK_Domains" variables

To load the ATT&CK data, pull down the collection index at this address
https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/index.json

Parse this collection index and select the collection's that correspond to the version ("ATT&CK_Versions") and domain ("ATT&CK_Domains") in the config file.

As an example, if v12.1 is the version, and enterprise, mobile and ics are the selected domains, access these from the collection index and load each collection.

Warning: Each collection will have cyclical records, in particular an identity and marking that is referenced by every object, and the collection that has a pointer to every object, including the identity and marking object, as well as referring to them in fields.

Using the instructions in #6 , then manually load everything in this order:

  1. First load the independent parts of the identity and marking objects
  2. Second, load the dependent parts of the identity and marking objects
  3. Third, load all of the other objects except for the collection
  4. Fourth, load the collection last

On Delete, the order of deletion must be in reverse

@brettforbes
Copy link
Collaborator Author

should be working properly now, some subtle errors fixed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
critical enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants