Skip to content

Load Mitre ATT&CK Data #18

@brettforbes

Description

@brettforbes

First get:

  1. Attack delete working Finalise add multi-protocol capability #8 Note: The collection must be deleted first, then all other objects, and finally the marking and identity are to be deleted
  2. Cyclical working Check add sub conditions (1. already exists, 2. cyclical, missing dependency) and document #6

Then add the loading of attack data to the typedb initialisation routine.

If ""ATT&CK"=True" in the import_types config object then:

  1. Load the Attack schema
  2. Load the Attack data based on the "ATT&CK_Versions" and "ATT&CK_Domains" variables

To load the ATT&CK data, pull down the collection index at this address
https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/index.json

Parse this collection index and select the collection's that correspond to the version ("ATT&CK_Versions") and domain ("ATT&CK_Domains") in the config file.

As an example, if v12.1 is the version, and enterprise, mobile and ics are the selected domains, access these from the collection index and load each collection.

Warning: Each collection will have cyclical records, in particular an identity and marking that is referenced by every object, and the collection that has a pointer to every object, including the identity and marking object, as well as referring to them in fields.

Using the instructions in #6 , then manually load everything in this order:

  1. First load the independent parts of the identity and marking objects
  2. Second, load the dependent parts of the identity and marking objects
  3. Third, load all of the other objects except for the collection
  4. Fourth, load the collection last

On Delete, the order of deletion must be in reverse

Metadata

Metadata

Assignees

Labels

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions