mitre-attack / mitre-attack/attack-stix-data
STIX objects with same ID and version but different data in 18.1
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 671
- Forks
- 145
- PR merge metrics
- No merged PRs in 30d
Description
The object with ID 'intrusion-set--68ba94ab-78b8-43e7-83e2-aed3466882c6' appears in both the ics-attack data as well as the enterprise-attack with the same version, however the 'x_mitre_domains' values differ.
According to STIX 2.1 specification, any change requires a new version of the object. In other words, either these objects should be exactly the same or they need to be different versions.
It appears that a simple fix would be to include both enterprise-attack and ics-attack in x_mitre_domains because it can have multiple values.
Same issue with intrusion-set--efed95ba-d7e8-47ff-8c53-99c42426ee7c, however in this case it is mobile-attack and enterprise-attack.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the 18.1 data entries for intrusion-set--68ba94ab-78b8-43e7-83e2-aed3466882c6 and intrusion-set--efed95ba-d7e8-47ff-8c53-99c42426ee7c across the ics-attack, enterprise-attack, and mobile-attack data. Compare their versions and x_mitre_domains values against the STIX 2.1 requirement, then update the conflicting objects so the shared IDs and versions have consistent data.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100