You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In the following function, if the technique ID does not match the target of any detects relationships (data component relationship), it removes the x_mitre_data_sources attribute. This happens to Mobile and ICS matrices. This is because ATT&CK has not added relationships for Mobile and ICS yet.
defenrich_techniques_data_sources(self, stix_object):
# Get 'detects' relationshipsrelationships=self.get_relationships(relationship_type='detects')
# Get all data component objectsdata_components=self.get_data_components()
# Get all data source objects without data components objectsdata_sources=self.get_data_sources()
# Create Data Sources and Data Components lookup tablesds_lookup= {ds['id']:dsfordsindata_sources}
dc_lookup= {dc['id']:dcfordcindata_components}
# https://stix2.readthedocs.io/en/latest/guide/versioning.htmlforiinrange(len(stix_object)):
if'x_mitre_data_sources'instix_object[i].keys():
technique_ds=dict()
forrlinrelationships:
ifstix_object[i]['id'] ==rl['target_ref']:
dc=dc_lookup[rl['source_ref']]
dc_ds_ref=dc['x_mitre_data_source_ref']
ifdc_ds_refnotintechnique_ds.keys():
technique_ds[dc_ds_ref] =ds_lookup[dc_ds_ref].copy()
technique_ds[dc_ds_ref]['data_components'] =list()
ifdcnotintechnique_ds[dc_ds_ref]['data_components']:
technique_ds[dc_ds_ref]['data_components'].append(dc)
new_data_sources= [ vforvintechnique_ds.values()]
stix_object[i] =stix_object[i].new_version(x_mitre_data_sources=new_data_sources)
returnstix_object
The text was updated successfully, but these errors were encountered:
In the following function, if the technique ID does not match the target of any
detects
relationships (data component relationship), it removes thex_mitre_data_sources
attribute. This happens to Mobile and ICS matrices. This is because ATT&CK has not added relationships for Mobile and ICS yet.The text was updated successfully, but these errors were encountered: