mitre-attack / mitre-attack/mitreattack-python

[Bug] Technique/tactic seems malformed

Open
#186 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
HTML
Stars
743
Forks
176
PR merge metrics
No merged PRs in 30d

Description

Expected Behavior

Using the exporters such as Excel or SVG using a local json file like https://github.com/mitre-attack/attack-stix-data/blob/master/enterprise-attack/enterprise-attack.json source should retrieve the proper data and produce the expected exported output with an output layer.

Actual Behavior

Every technique and subtechnique I was testing worked perfectly expect for this one : T1078.004

The error message is :
WARNING! Technique/Tactic T1078.004/(none) seems malformed. Skipping...

Steps to Reproduce the Problem

from mitreattack.navlayers.core import Layer
from mitreattack.navlayers.exporters.to_excel import ToExcel

lay = Layer()
lay.from_file("C:path_to_layer.json")

t2 = ToExcel(domain='enterprise', source='local', resource='path_to_enterprise-attack.json')
t2.to_xlsx(layerInit=lay, filepath="demo.xlsx")

The layer i'm using is

{
    "name": "example layer",
    "domain": "enterprise-attack",
    "description": "demo xlsx",
    "versions": {
        "layer": "4.5",
        "attack": "16.1",
        "navigator": "5.1.0"
    },
    "filters": {
        "platforms": [
            "Windows",
            "macOS"
        ]
    },
    "sorting": 2,
    "layout": {
        "layout": "side",
        "showID": true,
        "showName": true,
        "showAggregateScores": true,
        "countUnscored": true,
        "aggregateFunction": "average",
        "expandedSubtechniques": "annotated"
    },
    "hideDisabled": false,
    "techniques": [
        {
            "techniqueID": "T1078",
            "color": "#00FF00",
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "comment": "https://attack.mitre.org/techniques/T1078/004/",
            "color": "#00FF00"
        }
    ],
    "gradient": {
        "colors": [
            "#ff6666",
            "#ffe766",
            "#8ec843"
        ],
        "minValue": 0,
        "maxValue": 100
    },
    "legendItems": [
        {
            "label": "Legend Item Label",
            "color": "#FF00FF"
        }
    ],
    "showTacticRowBackground": true,
    "tacticRowBackground": "#dddddd",
    "selectTechniquesAcrossTactics": false,
    "selectSubtechniquesWithParent": false,
    "selectVisibleTechniques": false,
    "metadata": [
        {
            "name": "layer metadata 1",
            "value": "layer metadata 1 value"
        },
        {
            "name": "layer metadata 2",
            "value": "layer metadata 2 value"
        }
    ]
}

Possible Solution

The problem is appearing here

                else:
                    parents = [x for x in layer.layer.techniques if x.techniqueID == tech.techniqueID.split(".")[0]]
                    if tech.tactic:
                        parents = [x for x in parents if x.tactic == tech.tactic]
                    if all([True if not x.showSubtechniques else False for x in parents]):
                        print(
                            "NOTE! Technique/Tactic " + tech.techniqueID + "/" + tac + " does not appear "
                            "to be visible in the matrix. Its parent appears to be hiding it."
                        )
                    else:
                        print(
                            "WARNING! Technique/Tactic " + tech.techniqueID + "/" + tac + " seems malformed. "
                            "Skipping..."
                        )

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the ToExcel exporter entry point and inspect the shown malformed-technique branch, especially how T1078.004 and its tactic are matched against the layer data. Reproduce the issue with the supplied layer and local enterprise-attack JSON. Done means exporting the layer includes T1078.004 in the output without the malformed warning.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.