mitre-attack / mitre-attack/attack-workbench-rest-api

Infer the value of x_mitre_domains on exported groups

Open
#133 1 comment 0 reactions 1 assignee View on GitHub

@ElJocko is already working on this.

Since Apr 6, 2022.

enhancement
Dominant language
JavaScript
Stars
57
Forks
18
Avg merge
6m
Merged PRs (30d)
2

Description

As a client of the ATT&CK Workbench REST API, I would like the x_mitre_domains field on groups (intrusion-sets) to be automatically populated when those objects are retrieved from the export endpoints (GET /api/collection-bundles and GET /api/stix-bundles). x_mitre_domains is used by tools like ATT&CK Navigator to determine the relevant domain of the group when loading data.

  • The domains of a group should be inferred from its relationships to objects in the knowledge base -- groups which map to enterprise techniques or software are implicitly part of the enterprise domain themselves. Users of the workbench frontend won't be maintaining the x_mitre_domains field of groups directly so they must be instead computed on export.
  • On the /api/stix-bundles/?domain=X, groups are behaviorally similar to secondary objects (objects included because they have mappings to objects within the domain), however groups inferred to be within the domain may themselves have secondary objects. For instance, a technique within the domain may cause the inclusion of a mapped group as a secondary object, which itself may cause the inclusion of a software mapped to the group.
  • Groups imported into the knowledge base will likely include x_mitre_domains values, but the Workbench should not assume that these values are up-to-date with custom mappings. It may be preferable to drop the x_mitre_domains field from intrusion-sets within the knowledge base to avoid accidental misuse of that field.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.