Refactor the `risk` property of `detection_abstract` to handle observable/risk/threat mappings more transparently
Open
Nobody has claimed this yet.
bug
- Dominant language
- Python
- Stars
- 139
- Forks
- 52
- Avg merge
- 1h 16m
- Merged PRs (30d)
- 3
Description
- The mappings between risk types and observable types/roles is complicated, confusing, and prone to logical errors and edge cases
- We should refactor it to be a transparent mapping between observable types (as in
SES_OBSERVABLE_TYPE_MAPPING) and risk/threat types - For example, we have users as
Attackersin many detections- Currently, these get mapped to risks instead of threats unintentionally
- Lou's PR (#234) will address this, but even then, user threat object will get the type
otherinstead of user
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the detection_abstract implementation and SES_OBSERVABLE_TYPE_MAPPING, then review how observable types, roles, risks, and threats are currently connected. Read PR #234 for the related user/Attacker behavior. Done means the mapping is transparent and user observables resolve to the intended user threat type rather than an unintended risk or other type.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- tooling
- Issue type
- Refactor
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100