mitre-attack / mitre-attack/mitreattack-python

[Request] Can you add attackToExcel.get_stix_data_from( "/path/to/export/folder") to make loading data much faster? Or some other more efficient cache file format?

Open
#73 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
HTML
Stars
743
Forks
176
PR merge metrics
No merged PRs in 30d

Description

Is your feature request related to a problem?

The example from the usage page we've been using takes an extremely long time to load.

Describe the solution you'd like

Just make it a little more clear (in the basic usage example) how we can not only export, but cache and import the att&ck matrix data rather than slowly loading it.

Describe alternatives you've considered

There doesn't seem to be one since the documentation only mentions an export feature, not import.

Additional context
import mitreattack.attackToExcel.attackToExcel as attackToExcel
import mitreattack.attackToExcel.stixToDf as stixToDf

# download and parse ATT&CK STIX data

# SUGGESTED ADDITION / PSEUDO CODE:
attackToExcel.export("enterprise-attack", "v8.1", "/path/to/export/folder")
# instead of:
# attackdata = attackToExcel.get_stix_data("enterprise-attack")
# allow:
attackdata = attackToExcel.get_stix_data_from( "/path/to/export/folder")
# END ADDITION

# get Pandas DataFrames for techniques, associated relationships, and citations
techniques_data = stixToDf.techniquesToDf(attackdata, "enterprise-attack") 

# show T1102 and sub-techniques of T1102
techniques_df = techniques_data["techniques"]
print(techniques_df[techniques_df["ID"].str.contains("T1102")]["name"])

And I don't really know if exporting as excel is the most efficient way to cache the data, probably not, but it seems to be the format supported. My only goal is to get the data into a DataFrame as efficiently as possible instead of having to go take a 5 minute coffee break to wait every time I restart my Jupyter kernel.

We're going to be solving this by adding some code to use Apache's Parquet to store the DataFrame efficiently, but that is not something that would make sense as a PR in a library designed for converting to Excel. That said, people shouldn't need to invent a caching solution for this, in my opinion. It would make sense to support it by default when the library takes 3-5 minutes to load into a DataFrame.

Like I said, I don't know if it really fits into the library since it's named to be an excel conversion tool, but I'm thinking something like:

attackToExcel.export_parquet("enterprise-attack", "v8.1", "/path/to/export/file")
attackdata = attackToExcel.import_parquet("/path/to/export/file")
techniques_data = stixToDf.techniquesToDf(attackdata, "enterprise-attack")

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the usage example and the attackToExcel.export and get_stix_data entry points, then review how stixToDf.techniquesToDf consumes the loaded data. Compare the proposed folder import and Parquet alternatives; done should include a documented, efficient reload path without requiring users to wait for repeated STIX parsing.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
data-engineering
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.