Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit6936825

Browse files
authored
Merge pull request#54 from UncoderIO/parse-tactics-without-duplicates
fixes in renders for avoid duplicates in mitre tags
2 parents6720e81 +7bb67e8 commit6936825

File tree

10 files changed

+51
-20
lines changed

10 files changed

+51
-20
lines changed

‎translator/app/routers/assistance.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616

1717
@asynccontextmanager
1818
asyncdeflifespan(app:FastAPI)->Generator[None,None,None]:# noqa: ARG001
19-
MitreConfig().update_mitre_config()
19+
MitreConfig(server=True).update_mitre_config()
2020
withopen(os.path.join(ROOT_PROJECT_PATH,"app/dictionaries/uncoder_meta_info_roota.json"))asfile:
2121
suggestions["roota"]=json.load(file)
2222
withopen(os.path.join(ROOT_PROJECT_PATH,"app/dictionaries/uncoder_meta_info_sigma.json"))asfile:

‎translator/app/translator/core/mitre.py‎

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
importos
33
importssl
44
importurllib.request
5+
fromjsonimportJSONDecodeError
56
fromurllib.errorimportHTTPError
67

78
fromapp.translator.tools.singleton_metaimportSingletonMeta
@@ -12,9 +13,11 @@ class MitreConfig(metaclass=SingletonMeta):
1213
config_url:str="https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json"
1314
mitre_source_types:tuple= ("mitre-attack",)
1415

15-
def__init__(self):
16+
def__init__(self,server:bool=False):
1617
self.tactics= {}
1718
self.techniques= {}
19+
ifnotserver:
20+
self.__load_mitre_configs_from_files()
1821

1922
@staticmethod
2023
def__revoked_or_deprecated(entry:dict)->bool:
@@ -88,20 +91,30 @@ def update_mitre_config(self) -> None: # noqa: PLR0912
8891
sub_technique_id=ref["external_id"]
8992
sub_technique_name=entry["name"]
9093
parent_technique_name=technique_map[sub_technique_id.split(".")[0]]
94+
parent_tactics=self.techniques.get(sub_technique_id.split(".")[0].lower(), {}).get(
95+
"tactic", []
96+
)
9197
sub_technique_name=f"{parent_technique_name} :{sub_technique_name}"
9298
self.techniques[ref["external_id"].lower()]= {
9399
"technique_id":ref["external_id"],
94100
"technique":sub_technique_name,
95101
"url":ref["url"],
102+
"tactic":parent_tactics
96103
}
97104
break
98105

99106
def__load_mitre_configs_from_files(self)->None:
100-
withopen(os.path.join(ROOT_PROJECT_PATH,"app/dictionaries/tactics.json"))asfile:
101-
self.tactics=json.load(file)
107+
try:
108+
withopen(os.path.join(ROOT_PROJECT_PATH,"app/dictionaries/tactics.json"))asfile:
109+
self.tactics=json.load(file)
110+
exceptJSONDecodeError:
111+
self.tactics= {}
102112

103-
withopen(os.path.join(ROOT_PROJECT_PATH,"app/dictionaries/techniques.json"))asfile:
104-
self.techniques=json.load(file)
113+
try:
114+
withopen(os.path.join(ROOT_PROJECT_PATH,"app/dictionaries/techniques.json"))asfile:
115+
self.techniques=json.load(file)
116+
exceptJSONDecodeError:
117+
self.techniques= {}
105118

106119
defget_tactic(self,tactic:str)->dict:
107120
tactic=tactic.replace(".","_")

‎translator/app/translator/core/mixins/rule.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ def load_rule(text: str) -> dict:
2727

2828
defparse_mitre_attack(self,tags:list[str])->dict[str,list]:
2929
result= {"tactics": [],"techniques": []}
30-
fortagintags:
30+
fortaginset(tags):
3131
tag=tag.lower()
3232
iftag.startswith("attack."):
3333
tag=tag[7::]

‎translator/app/translator/platforms/elasticsearch/renders/detection_rule.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ def __create_mitre_threat(self, mitre_attack: dict) -> Union[list, list[dict]]:
6060
if"."intechnique_name:
6161
technique_name=technique_name[:technique_name.index(".")]
6262
threat.append(technique_name)
63-
returnthreat
63+
returnsorted(threat)
6464

6565
fortacticinmitre_attack["tactics"]:
6666
tactic_render= {"id":tactic["external_id"],"name":tactic["tactic"],"reference":tactic["url"]}
@@ -81,7 +81,7 @@ def __create_mitre_threat(self, mitre_attack: dict) -> Union[list, list[dict]]:
8181
iflen(sub_threat["technique"])>0:
8282
threat.append(sub_threat)
8383

84-
returnthreat
84+
returnsorted(threat,key=lambdax:x["tactic"]["id"])
8585

8686
deffinalize_query(
8787
self,

‎translator/app/translator/platforms/logscale/renders/logscale_alert.py‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,10 @@ def finalize_query(
5656
rule["name"]=meta_info.titleor_AUTOGENERATED_TITLE
5757
mitre_attack= []
5858
ifmeta_info.mitre_attack:
59-
mitre_attack= [f"ATTACK.{i['tactic']}"foriinmeta_info.mitre_attack.get("tactics", [])]
60-
mitre_attack.extend([f"ATTACK.{i['technique_id']}"foriinmeta_info.mitre_attack.get("techniques", [])])
59+
mitre_attack=sorted([f"ATTACK.{i['tactic']}"foriinmeta_info.mitre_attack.get("tactics", [])])
60+
mitre_attack.extend(
61+
sorted([f"ATTACK.{i['technique_id']}"foriinmeta_info.mitre_attack.get("techniques", [])])
62+
)
6163
rule["description"]=get_rule_description_str(
6264
description=meta_info.description,
6365
license_=meta_info.license,

‎translator/app/translator/platforms/microsoft/renders/microsoft_sentinel_rule.py‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -49,16 +49,19 @@ class MicrosoftSentinelRuleRender(MicrosoftSentinelQueryRender):
4949
field_value_map=MicrosoftSentinelRuleFieldValue(or_token=or_token)
5050

5151
def__create_mitre_threat(self,meta_info:MetaInfoContainer)->tuple[list,list]:
52-
tactics=[]
52+
tactics=set()
5353
techniques= []
5454

55-
fortacticinmeta_info.mitre_attack.get("tactics", []):
56-
tactics.append(tactic["tactic"])
55+
fortacticinmeta_info.mitre_attack.get("tactics"):
56+
tactics.add(tactic["tactic"])
5757

58-
fortechniqueinmeta_info.mitre_attack.get("techniques", []):
58+
fortechniqueinmeta_info.mitre_attack.get("techniques"):
59+
iftechnique.get("tactic"):
60+
fortacticintechnique["tactic"]:
61+
tactics.add(tactic)
5962
techniques.append(technique["technique_id"])
6063

61-
returntactics,techniques
64+
returnsorted(tactics),sorted(techniques)
6265

6366
deffinalize_query(
6467
self,

‎translator/app/translator/platforms/sigma/parsers/sigma.py‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@
1717
-----------------------------------------------------------------
1818
"""
1919

20-
2120
fromtypingimportUnion
2221

2322
fromapp.translator.core.exceptions.coreimportSigmaRuleValidationException
@@ -56,7 +55,7 @@ def _get_meta_info(self, rule: dict, source_mapping_ids: list[str]) -> MetaInfoC
5655
mitre_attack=self.parse_mitre_attack(rule.get("tags", [])),
5756
severity=rule.get("level"),
5857
status=rule.get("status"),
59-
tags=sorted(set(rule.get("tags")or [])),
58+
tags=sorted(set(rule.get("tags", []))),
6059
false_positives=self.__parse_false_positives(rule.get("falsepositives")),
6160
source_mapping_ids=source_mapping_ids,
6261
)

‎translator/app/translator/platforms/splunk/renders/splunk_alert.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,10 @@ class SplunkAlertRender(SplunkQueryRender):
4343
def__create_mitre_threat(meta_info:MetaInfoContainer)->dict:
4444
techniques= {"mitre_attack": []}
4545

46-
fortechniqueinmeta_info.mitre_attack.get("techniques", []):
46+
fortechniqueinmeta_info.mitre_attack.get("techniques"):
4747
techniques["mitre_attack"].append(technique["technique_id"])
4848

49+
techniques["mitre_attack"].sort()
4950
returntechniques
5051

5152
deffinalize_query(

‎translator/server.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020

2121

2222
if__name__=="__main__":
23-
host=os.environ.get("HOST","127.0.0.1")
23+
host=os.environ.get("HOST","0.0.0.0")
2424
port=os.environ.get("PORT","8000")
2525
ifnotport.isnumeric():
2626
raiseException("Port should be a number!")

‎update_local_mitre.py‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
importjson
2+
importos
3+
4+
fromtranslator.app.translator.core.mitreimportMitreConfig
5+
fromtranslator.constimportROOT_PROJECT_PATH
6+
7+
mitre_config=MitreConfig()
8+
mitre_config.update_mitre_config()
9+
withopen(os.path.join(ROOT_PROJECT_PATH,"app/dictionaries/tactics.json"),"w")asfile:
10+
json.dump(mitre_config.tactics,file,indent=4)
11+
12+
withopen(os.path.join(ROOT_PROJECT_PATH,"app/dictionaries/techniques.json"),"w")asfile:
13+
json.dump(mitre_config.techniques,file,indent=4)

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp