mitre-attack / mitre-attack/attack-stix-data
STIX versioning appears to be broken across all current versions of the ATT&CK JSON
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 671
- Forks
- 145
- PR merge metrics
- No merged PRs in 30d
Description
I believe STIX versioning isn't properly implemented/applied to whatever is generating the current ATT&CK JSON.
From section 3.6 Versioning of the STIX 2.1 spec:
STIX Objects MAY be versioned in order to update, add, or remove information. A version of a STIX Object is identified uniquely by the combination of its id and modified properties. The first version of the object MUST have the same timestamp for the created and modified properties. More recent values of the modified property indicate later versions of the object. Implementations MUST consider the version of the STIX Object with the most recent modified value to be the most recent state of the object. For every new version of an object, the modified property MUST be updated to represent the time that the new version was created. If a consumer receives two objects that are different, but have the same id and modified timestamp, it is not defined how the consumer handles the objects. This specification does not address how implementations should handle versions of the object that are not current.
There are 422 attack-patterns in the current JSON that have non-matching creation/modification times and are missing the required revoked property. There are 297 attack-patterns that do have the revoked property. The first attack-pattern (['objects'][1]) in the is an example of an object that is clearly versioned, but doesn't have the requisite properties.
attack-pattern--0042a9f5-f053-4769-b3ef-9ad018dfa298 is versioned but missing 'revoked':
created: 2020-01-14T17:18:32.126Z
modified 2022-04-25T14:00:00.188Z
['objects'][1].keys()
['x_mitre_platforms', 'x_mitre_domains', 'object_marking_refs', 'id', 'type', 'created', 'created_by_ref', 'external_references', 'modified', 'name', 'description', 'kill_chain_phases', 'x_mitre_detection', 'x_mitre_is_subtechnique', 'x_mitre_version', 'x_mitre_modified_by_ref', 'x_mitre_data_sources', 'x_mitre_defense_bypassed', 'spec_version', 'x_mitre_attack_spec_version']
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by inspecting the current ATT&CK JSON, especially objects[1] and attack-pattern--0042a9f5-f053-4769-b3ef-9ad018dfa298, then locate the generator that produces these objects. Compare all generated attack-patterns with the STIX 2.1 section 3.6 requirements; done means versioned objects have consistent timestamps and the required revoked property.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- data, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100