Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

fixes in renders for avoid duplicates in mitre tags#54

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
tarnopolskyi merged 1 commit intomainfromparse-tactics-without-duplicates
Feb 6, 2024
Merged
Show file tree
Hide file tree
Changes fromall commits
Commits
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletiontranslator/app/routers/assistance.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -16,7 +16,7 @@

@asynccontextmanager
async def lifespan(app: FastAPI) -> Generator[None, None, None]: # noqa: ARG001
MitreConfig().update_mitre_config()
MitreConfig(server=True).update_mitre_config()
with open(os.path.join(ROOT_PROJECT_PATH, "app/dictionaries/uncoder_meta_info_roota.json")) as file:
suggestions["roota"] = json.load(file)
with open(os.path.join(ROOT_PROJECT_PATH, "app/dictionaries/uncoder_meta_info_sigma.json")) as file:
Expand Down
23 changes: 18 additions & 5 deletionstranslator/app/translator/core/mitre.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -2,6 +2,7 @@
import os
import ssl
import urllib.request
from json import JSONDecodeError
from urllib.error import HTTPError

from app.translator.tools.singleton_meta import SingletonMeta
Expand All@@ -12,9 +13,11 @@ class MitreConfig(metaclass=SingletonMeta):
config_url: str = "https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json"
mitre_source_types: tuple = ("mitre-attack",)

def __init__(self):
def __init__(self, server: bool = False):
self.tactics = {}
self.techniques = {}
if not server:
self.__load_mitre_configs_from_files()

@staticmethod
def __revoked_or_deprecated(entry: dict) -> bool:
Expand DownExpand Up@@ -88,20 +91,30 @@ def update_mitre_config(self) -> None: # noqa: PLR0912
sub_technique_id = ref["external_id"]
sub_technique_name = entry["name"]
parent_technique_name = technique_map[sub_technique_id.split(".")[0]]
parent_tactics = self.techniques.get(sub_technique_id.split(".")[0].lower(), {}).get(
"tactic", []
)
sub_technique_name = f"{parent_technique_name} : {sub_technique_name}"
self.techniques[ref["external_id"].lower()] = {
"technique_id": ref["external_id"],
"technique": sub_technique_name,
"url": ref["url"],
"tactic": parent_tactics
}
break

def __load_mitre_configs_from_files(self) -> None:
with open(os.path.join(ROOT_PROJECT_PATH, "app/dictionaries/tactics.json")) as file:
self.tactics = json.load(file)
try:
with open(os.path.join(ROOT_PROJECT_PATH, "app/dictionaries/tactics.json")) as file:
self.tactics = json.load(file)
except JSONDecodeError:
self.tactics = {}

with open(os.path.join(ROOT_PROJECT_PATH, "app/dictionaries/techniques.json")) as file:
self.techniques = json.load(file)
try:
with open(os.path.join(ROOT_PROJECT_PATH, "app/dictionaries/techniques.json")) as file:
self.techniques = json.load(file)
except JSONDecodeError:
self.techniques = {}

def get_tactic(self, tactic: str) -> dict:
tactic = tactic.replace(".", "_")
Expand Down
2 changes: 1 addition & 1 deletiontranslator/app/translator/core/mixins/rule.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -27,7 +27,7 @@ def load_rule(text: str) -> dict:

def parse_mitre_attack(self, tags: list[str]) -> dict[str, list]:
result = {"tactics": [], "techniques": []}
for tag in tags:
for tag inset(tags):
tag = tag.lower()
if tag.startswith("attack."):
tag = tag[7::]
Expand Down
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -60,7 +60,7 @@ def __create_mitre_threat(self, mitre_attack: dict) -> Union[list, list[dict]]:
if "." in technique_name:
technique_name = technique_name[: technique_name.index(".")]
threat.append(technique_name)
return threat
returnsorted(threat)

for tactic in mitre_attack["tactics"]:
tactic_render = {"id": tactic["external_id"], "name": tactic["tactic"], "reference": tactic["url"]}
Expand All@@ -81,7 +81,7 @@ def __create_mitre_threat(self, mitre_attack: dict) -> Union[list, list[dict]]:
if len(sub_threat["technique"]) > 0:
threat.append(sub_threat)

return threat
returnsorted(threat, key=lambda x: x["tactic"]["id"])

def finalize_query(
self,
Expand Down
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -56,8 +56,10 @@ def finalize_query(
rule["name"] = meta_info.title or _AUTOGENERATED_TITLE
mitre_attack = []
if meta_info.mitre_attack:
mitre_attack = [f"ATTACK.{i['tactic']}" for i in meta_info.mitre_attack.get("tactics", [])]
mitre_attack.extend([f"ATTACK.{i['technique_id']}" for i in meta_info.mitre_attack.get("techniques", [])])
mitre_attack = sorted([f"ATTACK.{i['tactic']}" for i in meta_info.mitre_attack.get("tactics", [])])
mitre_attack.extend(
sorted([f"ATTACK.{i['technique_id']}" for i in meta_info.mitre_attack.get("techniques", [])])
)
rule["description"] = get_rule_description_str(
description=meta_info.description,
license_=meta_info.license,
Expand Down
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -49,16 +49,19 @@ class MicrosoftSentinelRuleRender(MicrosoftSentinelQueryRender):
field_value_map = MicrosoftSentinelRuleFieldValue(or_token=or_token)

def __create_mitre_threat(self, meta_info: MetaInfoContainer) -> tuple[list, list]:
tactics =[]
tactics =set()
techniques = []

for tactic in meta_info.mitre_attack.get("tactics", []):
tactics.append(tactic["tactic"])
for tactic in meta_info.mitre_attack.get("tactics"):
tactics.add(tactic["tactic"])

for technique in meta_info.mitre_attack.get("techniques", []):
for technique in meta_info.mitre_attack.get("techniques"):
if technique.get("tactic"):
for tactic in technique["tactic"]:
tactics.add(tactic)
techniques.append(technique["technique_id"])

return tactics,techniques
returnsorted(tactics), sorted(techniques)

def finalize_query(
self,
Expand Down
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -17,7 +17,6 @@
-----------------------------------------------------------------
"""


from typing import Union

from app.translator.core.exceptions.core import SigmaRuleValidationException
Expand DownExpand Up@@ -56,7 +55,7 @@ def _get_meta_info(self, rule: dict, source_mapping_ids: list[str]) -> MetaInfoC
mitre_attack=self.parse_mitre_attack(rule.get("tags", [])),
severity=rule.get("level"),
status=rule.get("status"),
tags=sorted(set(rule.get("tags") or [])),
tags=sorted(set(rule.get("tags", []))),
false_positives=self.__parse_false_positives(rule.get("falsepositives")),
source_mapping_ids=source_mapping_ids,
)
Expand Down
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -43,9 +43,10 @@ class SplunkAlertRender(SplunkQueryRender):
def __create_mitre_threat(meta_info: MetaInfoContainer) -> dict:
techniques = {"mitre_attack": []}

for technique in meta_info.mitre_attack.get("techniques", []):
for technique in meta_info.mitre_attack.get("techniques"):
techniques["mitre_attack"].append(technique["technique_id"])

techniques["mitre_attack"].sort()
return techniques

def finalize_query(
Expand Down
2 changes: 1 addition & 1 deletiontranslator/server.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -20,7 +20,7 @@


if __name__ == "__main__":
host = os.environ.get("HOST", "127.0.0.1")
host = os.environ.get("HOST", "0.0.0.0")
port = os.environ.get("PORT", "8000")
if not port.isnumeric():
raise Exception("Port should be a number!")
Expand Down
13 changes: 13 additions & 0 deletionsupdate_local_mitre.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
import json
import os

from translator.app.translator.core.mitre import MitreConfig
from translator.const import ROOT_PROJECT_PATH

mitre_config = MitreConfig()
mitre_config.update_mitre_config()
with open(os.path.join(ROOT_PROJECT_PATH, "app/dictionaries/tactics.json"), "w") as file:
json.dump(mitre_config.tactics, file, indent=4)

with open(os.path.join(ROOT_PROJECT_PATH, "app/dictionaries/techniques.json"), "w") as file:
json.dump(mitre_config.techniques, file, indent=4)
[8]ページ先頭
©2009-2025 Movatter.jp