mitre-attack / mitre-attack/mitreattack-python
[Bug] Technique/tactic seems malformed
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 743
- Forks
- 176
- PR merge metrics
- No merged PRs in 30d
Description
Expected Behavior
Using the exporters such as Excel or SVG using a local json file like https://github.com/mitre-attack/attack-stix-data/blob/master/enterprise-attack/enterprise-attack.json source should retrieve the proper data and produce the expected exported output with an output layer.
Actual Behavior
Every technique and subtechnique I was testing worked perfectly expect for this one : T1078.004
The error message is :
WARNING! Technique/Tactic T1078.004/(none) seems malformed. Skipping...
Steps to Reproduce the Problem
from mitreattack.navlayers.core import Layer
from mitreattack.navlayers.exporters.to_excel import ToExcel
lay = Layer()
lay.from_file("C:path_to_layer.json")
t2 = ToExcel(domain='enterprise', source='local', resource='path_to_enterprise-attack.json')
t2.to_xlsx(layerInit=lay, filepath="demo.xlsx")
The layer i'm using is
{
"name": "example layer",
"domain": "enterprise-attack",
"description": "demo xlsx",
"versions": {
"layer": "4.5",
"attack": "16.1",
"navigator": "5.1.0"
},
"filters": {
"platforms": [
"Windows",
"macOS"
]
},
"sorting": 2,
"layout": {
"layout": "side",
"showID": true,
"showName": true,
"showAggregateScores": true,
"countUnscored": true,
"aggregateFunction": "average",
"expandedSubtechniques": "annotated"
},
"hideDisabled": false,
"techniques": [
{
"techniqueID": "T1078",
"color": "#00FF00",
"showSubtechniques": true
},
{
"techniqueID": "T1078.004",
"comment": "https://attack.mitre.org/techniques/T1078/004/",
"color": "#00FF00"
}
],
"gradient": {
"colors": [
"#ff6666",
"#ffe766",
"#8ec843"
],
"minValue": 0,
"maxValue": 100
},
"legendItems": [
{
"label": "Legend Item Label",
"color": "#FF00FF"
}
],
"showTacticRowBackground": true,
"tacticRowBackground": "#dddddd",
"selectTechniquesAcrossTactics": false,
"selectSubtechniquesWithParent": false,
"selectVisibleTechniques": false,
"metadata": [
{
"name": "layer metadata 1",
"value": "layer metadata 1 value"
},
{
"name": "layer metadata 2",
"value": "layer metadata 2 value"
}
]
}
Possible Solution
The problem is appearing here
else:
parents = [x for x in layer.layer.techniques if x.techniqueID == tech.techniqueID.split(".")[0]]
if tech.tactic:
parents = [x for x in parents if x.tactic == tech.tactic]
if all([True if not x.showSubtechniques else False for x in parents]):
print(
"NOTE! Technique/Tactic " + tech.techniqueID + "/" + tac + " does not appear "
"to be visible in the matrix. Its parent appears to be hiding it."
)
else:
print(
"WARNING! Technique/Tactic " + tech.techniqueID + "/" + tac + " seems malformed. "
"Skipping..."
)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the ToExcel exporter entry point and inspect the shown malformed-technique branch, especially how T1078.004 and its tactic are matched against the layer data. Reproduce the issue with the supplied layer and local enterprise-attack JSON. Done means exporting the layer includes T1078.004 in the output without the malformed warning.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100