Kill Chain steps not populated for detections
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 139
- Forks
- 52
- Avg merge
- 1h 16m
- Merged PRs (30d)
- 3
Description
Hi team,
This is not a high priority ask, however we noticed that in the ESCU app, detections will be properly tagged with the Kill Chain steps but not in the apps created using contentctl. This is using identical yaml files for a given detection.
I've gone through both code bases and can't seem to pinpoint where the problem lies, though I did notice that in contentctl's director.py, the method addKillChainPhase() is invoked slightly differently than the one in security_content. That said, I could be way off, but wanted to point that out in case it helps.
Thanks in advance!
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing contentctl's director.py invocation of addKillChainPhase() with the corresponding security_content behavior, using the identical detection YAML files described in the issue. Reproduce the generated apps and verify that their detections contain the expected Kill Chain steps; done means contentctl populates them consistently with ESCU.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100