infosecn1nja
/
DeTTECT
mirror of https://github.com/infosecn1nja/DeTTECT.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Added support for tech. admin. file version 1.1

master
Marcus Bakker 2019-04-23 13:22:03 +02:00
parent 26776f0468
commit 72f1722746
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
data_source_mapping.py
View File

@ -214,12 +214,14 @@ def generate_technique_administration_file(filename):
techniques = load_attack_data(DATATYPE_ALL_TECH) techniques = load_attack_data(DATATYPE_ALL_TECH)
# This is part of the techniques administration YAML file and is used as a template # This is part of the techniques administration YAML file and is used as a template
dict_tech = {'technique_id': '', 'detection': {'date_registered': None, 'date_implemented': None, 'score': -1, dict_tech = {'technique_id': '', 'technique_name': '', 'detection': {'applicable_to': ['all'],
'location': [''], 'comment': ''}, 'date_registered': None,
'visibility': {'score': 0, 'comment': ''}} 'date_implemented': None,
'score': -1, 'location': [''], 'comment': ''},
'visibility': {'applicable_to': ['all'], 'score': 0, 'comment': ''}}
yaml_file = {} yaml_file = {}
yaml_file['version'] = 1.0 yaml_file['version'] = FILE_TYPE_TECHNIQUE_ADMINISTRATION_VERSION
yaml_file['file_type'] = FILE_TYPE_TECHNIQUE_ADMINISTRATION yaml_file['file_type'] = FILE_TYPE_TECHNIQUE_ADMINISTRATION
yaml_file['name'] = name yaml_file['name'] = name
yaml_file['platform'] = platform yaml_file['platform'] = platform
@ -248,6 +250,7 @@ def generate_technique_administration_file(filename):
if score > 0 and t['technique_id'] not in techniques_upper: if score > 0 and t['technique_id'] not in techniques_upper:
tech = copy.deepcopy(dict_tech) tech = copy.deepcopy(dict_tech)
tech['technique_id'] = t['technique_id'] tech['technique_id'] = t['technique_id']
tech['technique_name'] = get_technique(techniques, t['technique_id'])['technique']
tech['visibility']['score'] = score tech['visibility']['score'] = score
yaml_file['techniques'].append(tech) yaml_file['techniques'].append(tech)