infosecn1nja
/
DeTTECT
mirror of https://github.com/infosecn1nja/DeTTECT.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

updatd the Python packages

master
Marcus Bakker 2020-10-16 11:36:05 +02:00
parent 4b1b7bd5e1
commit 8456033337
4 changed files with 18 additions and 43 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
editor/script/refresh_attack_data.py
View File

@ -16,21 +16,9 @@ class ATTACKData():
self.mitre = attack_client() self.mitre = attack_client()
self.attack_cti_techniques = self.mitre.get_enterprise_techniques() self.attack_cti_techniques = self.mitre.get_enterprise_techniques()
self.attack_cti_techniques = self.mitre.remove_revoked(self.attack_cti_techniques) self.attack_cti_techniques = self.mitre.remove_revoked(self.attack_cti_techniques)
self.attack_cti_techniques = self.remove_deprecated(self.attack_cti_techniques) self.attack_cti_techniques = self.mitre.remove_deprecated(self.attack_cti_techniques)
self.attack_cti_software = self.mitre.get_software() self.attack_cti_software = self.mitre.get_software()
self.attack_cti_software = self.remove_deprecated(self.attack_cti_software) self.attack_cti_software = self.mitre.remove_deprecated(self.attack_cti_software)
def remove_deprecated(self, stix_objects):
"""
Remove deprecated STIX objects
:param stix_objects: list of STIX objects
:return: a list of STIX objects
"""
handle_deprecated = list()
for obj in stix_objects:
if not('x_mitre_deprecated' in obj.keys() and obj['x_mitre_deprecated'] == True):
handle_deprecated.append(obj)
return handle_deprecated
def dump_data(self, data, filename): def dump_data(self, data, filename):
""" """

2
editor/script/requirements.txt
View File

@ -1 +1 @@
attackcti==0.3.2 attackcti==0.3.3

27
generic.py
View File

@ -28,19 +28,6 @@ def _save_attack_data(data, path):
pickle.dump([data, dt.now()], f) pickle.dump([data, dt.now()], f)
def remove_deprecated(stix_objects):
"""
Remove deprecated STIX objects
:param stix_objects: list of STIX objects
:return: a list of STIX objects
"""
handle_deprecated = list()
for obj in stix_objects:
if not('x_mitre_deprecated' in obj.keys() and obj['x_mitre_deprecated'] == True):
handle_deprecated.append(obj)
return handle_deprecated
def load_attack_data(data_type): def load_attack_data(data_type):
""" """
By default the ATT&CK data is loaded from the online TAXII server or from the local cache directory. The By default the ATT&CK data is loaded from the online TAXII server or from the local cache directory. The
@ -74,11 +61,11 @@ def load_attack_data(data_type):
if data_type == DATA_TYPE_STIX_ALL_RELATIONSHIPS: if data_type == DATA_TYPE_STIX_ALL_RELATIONSHIPS:
attack_data = mitre.get_relationships() attack_data = mitre.get_relationships()
attack_data = mitre.remove_revoked(attack_data) attack_data = mitre.remove_revoked(attack_data)
attack_data = remove_deprecated(attack_data) attack_data = mitre.remove_deprecated(attack_data)
elif data_type == DATA_TYPE_STIX_ALL_TECH_ENTERPRISE: elif data_type == DATA_TYPE_STIX_ALL_TECH_ENTERPRISE:
attack_data = mitre.get_enterprise_techniques() attack_data = mitre.get_enterprise_techniques()
attack_data = mitre.remove_revoked(attack_data) attack_data = mitre.remove_revoked(attack_data)
attack_data = remove_deprecated(attack_data) attack_data = mitre.remove_deprecated(attack_data)
elif data_type == DATA_TYPE_CUSTOM_TECH_BY_GROUP: elif data_type == DATA_TYPE_CUSTOM_TECH_BY_GROUP:
# First we need to know which technique references (STIX Object type 'attack-pattern') we have for all # First we need to know which technique references (STIX Object type 'attack-pattern') we have for all
# groups. This results in a dict: {group_id: Gxxxx, technique_ref/attack-pattern_ref: ...} # groups. This results in a dict: {group_id: Gxxxx, technique_ref/attack-pattern_ref: ...}
@ -120,15 +107,15 @@ def load_attack_data(data_type):
elif data_type == DATA_TYPE_STIX_ALL_TECH: elif data_type == DATA_TYPE_STIX_ALL_TECH:
attack_data = mitre.get_techniques() attack_data = mitre.get_techniques()
attack_data = mitre.remove_revoked(attack_data) attack_data = mitre.remove_revoked(attack_data)
attack_data = remove_deprecated(attack_data) attack_data = mitre.remove_deprecated(attack_data)
elif data_type == DATA_TYPE_STIX_ALL_GROUPS: elif data_type == DATA_TYPE_STIX_ALL_GROUPS:
attack_data = mitre.get_groups() attack_data = mitre.get_groups()
attack_data = mitre.remove_revoked(attack_data) attack_data = mitre.remove_revoked(attack_data)
attack_data = remove_deprecated(attack_data) attack_data = mitre.remove_deprecated(attack_data)
elif data_type == DATA_TYPE_STIX_ALL_SOFTWARE: elif data_type == DATA_TYPE_STIX_ALL_SOFTWARE:
attack_data = mitre.get_software() attack_data = mitre.get_software()
attack_data = mitre.remove_revoked(attack_data) attack_data = mitre.remove_revoked(attack_data)
attack_data = remove_deprecated(attack_data) attack_data = mitre.remove_deprecated(attack_data)
elif data_type == DATA_TYPE_CUSTOM_TECH_BY_SOFTWARE: elif data_type == DATA_TYPE_CUSTOM_TECH_BY_SOFTWARE:
# First we need to know which technique references (STIX Object type 'attack-pattern') we have for all software # First we need to know which technique references (STIX Object type 'attack-pattern') we have for all software
# This results in a dict: {software_id: Sxxxx, technique_ref/attack-pattern_ref: ...} # This results in a dict: {software_id: Sxxxx, technique_ref/attack-pattern_ref: ...}
@ -195,12 +182,12 @@ def load_attack_data(data_type):
elif data_type == DATA_TYPE_STIX_ALL_ENTERPRISE_MITIGATIONS: elif data_type == DATA_TYPE_STIX_ALL_ENTERPRISE_MITIGATIONS:
attack_data = mitre.get_enterprise_mitigations() attack_data = mitre.get_enterprise_mitigations()
attack_data = mitre.remove_revoked(attack_data) attack_data = mitre.remove_revoked(attack_data)
attack_data = remove_deprecated(attack_data) attack_data = mitre.remove_deprecated(attack_data)
elif data_type == DATA_TYPE_STIX_ALL_MOBILE_MITIGATIONS: elif data_type == DATA_TYPE_STIX_ALL_MOBILE_MITIGATIONS:
attack_data = mitre.get_mobile_mitigations() attack_data = mitre.get_mobile_mitigations()
attack_data = mitre.remove_revoked(attack_data) attack_data = mitre.remove_revoked(attack_data)
attack_data = remove_deprecated(attack_data) attack_data = mitre.remove_deprecated(attack_data)
# Only use cache when using online TAXII server: # Only use cache when using online TAXII server:
if local_stix_path is None: if local_stix_path is None:

16
requirements.txt
View File

@ -1,8 +1,8 @@
attackcti==0.3.2 attackcti==0.3.3
simplejson==3.17.0 simplejson==3.17.2
plotly==4.8.1 plotly==4.11.0
pandas==1.0.3 pandas==1.1.3
xlsxwriter==1.2.8 xlsxwriter==1.3.7
ruamel.yaml==0.16.10 ruamel.yaml==0.16.12
eql==0.9.1 eql==0.9.4
taxii2-client==2.0.0 taxii2-client==2.2.2