mitre-attack / mitre-attack/attack-workbench-rest-api
Infer the value of x_mitre_domains on exported groups
Open
@ElJocko is already working on this.
Since Apr 6, 2022.
enhancement
- Dominant language
- JavaScript
- Stars
- 57
- Forks
- 18
- Avg merge
- 6m
- Merged PRs (30d)
- 2
Description
As a client of the ATT&CK Workbench REST API, I would like the x_mitre_domains field on groups (intrusion-sets) to be automatically populated when those objects are retrieved from the export endpoints (GET /api/collection-bundles and GET /api/stix-bundles). x_mitre_domains is used by tools like ATT&CK Navigator to determine the relevant domain of the group when loading data.
- The domains of a group should be inferred from its relationships to objects in the knowledge base -- groups which map to enterprise techniques or software are implicitly part of the enterprise domain themselves. Users of the workbench frontend won't be maintaining the
x_mitre_domainsfield of groups directly so they must be instead computed on export. - On the
/api/stix-bundles/?domain=X, groups are behaviorally similar to secondary objects (objects included because they have mappings to objects within the domain), however groups inferred to be within the domain may themselves have secondary objects. For instance, a technique within the domain may cause the inclusion of a mapped group as a secondary object, which itself may cause the inclusion of a software mapped to the group. - Groups imported into the knowledge base will likely include
x_mitre_domainsvalues, but the Workbench should not assume that these values are up-to-date with custom mappings. It may be preferable to drop thex_mitre_domainsfield fromintrusion-sets within the knowledge base to avoid accidental misuse of that field.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.