mitre-attack / mitre-attack/attack-stix-data

STIX versioning appears to be broken across all current versions of the ATT&CK JSON

Open
#20 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
671
Forks
145
PR merge metrics
No merged PRs in 30d

Description

I believe STIX versioning isn't properly implemented/applied to whatever is generating the current ATT&CK JSON.

From section 3.6 Versioning of the STIX 2.1 spec:

STIX Objects MAY be versioned in order to update, add, or remove information. A version of a STIX Object is identified uniquely by the combination of its id and modified properties. The first version of the object MUST have the same timestamp for the created and modified properties. More recent values of the modified property indicate later versions of the object. Implementations MUST consider the version of the STIX Object with the most recent modified value to be the most recent state of the object. For every new version of an object, the modified property MUST be updated to represent the time that the new version was created. If a consumer receives two objects that are different, but have the same id and modified timestamp, it is not defined how the consumer handles the objects. This specification does not address how implementations should handle versions of the object that are not current.

There are 422 attack-patterns in the current JSON that have non-matching creation/modification times and are missing the required revoked property. There are 297 attack-patterns that do have the revoked property. The first attack-pattern (['objects'][1]) in the is an example of an object that is clearly versioned, but doesn't have the requisite properties.

attack-pattern--0042a9f5-f053-4769-b3ef-9ad018dfa298 is versioned but missing 'revoked':
created: 2020-01-14T17:18:32.126Z
modified 2022-04-25T14:00:00.188Z

['objects'][1].keys()
['x_mitre_platforms', 'x_mitre_domains', 'object_marking_refs', 'id', 'type', 'created', 'created_by_ref', 'external_references', 'modified', 'name', 'description', 'kill_chain_phases', 'x_mitre_detection', 'x_mitre_is_subtechnique', 'x_mitre_version', 'x_mitre_modified_by_ref', 'x_mitre_data_sources', 'x_mitre_defense_bypassed', 'spec_version', 'x_mitre_attack_spec_version']

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by inspecting the current ATT&CK JSON, especially objects[1] and attack-pattern--0042a9f5-f053-4769-b3ef-9ad018dfa298, then locate the generator that produces these objects. Compare all generated attack-patterns with the STIX 2.1 section 3.6 requirements; done means versioned objects have consistent timestamps and the required revoked property.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
data, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.