Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Missing x-mitre-data-component refs in ICSv20

Aperta
  • Qualcosa non va?
#78 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
45/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
json, python
Ambito
data

Direzione di ricerca

Start with the ICS STIX data: the ics-attack/x-mitre-data-component/ folder and the ics-attack/x-mitre-analytic/ files the issue links, then compare them with enterprise-attack/x-mitre-data-component/. Check whether the four listed data-component IDs (for example x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6) should be present in the ICS set. Done means every x_mitre_log_source_references in the ICS analytics resolves to a file in the ICS data. The maintainers still need to decide whether shared objects belong in each matrix, so confirm that before changing the data.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Some x-mitre-data-component referenced in x_mitre_log_source_references of x-mitre-analytic objects are missing from the ICS json file.

The missing x-mitre-data-component are however present in the Enterprise json file.

In the past, the assumption that a JSON file was standalone hold true. All objects were always present in each file and thus sometimes the same was in multiple matrix files.

Is this assumption wrong or the missing x-mitre-data-component objects are an oversight ?

Example (from mitre/cti as objects are also provided separated):

The exact lists:

Missing data-component refs in ICS: 4

  x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6
    name='Process Access'  found_in=enterprise
    referenced by 4 analytic log-source(s):
      - analytic 'Analytic 1855' (x-mitre-analytic--05ca4f07-df4f-4e88-b216-f40ca6ce39b8) log_source='WinEventLog:Sysmon'
      - analytic 'Analytic 1899' (x-mitre-analytic--3e456d4d-397d-4e04-9261-9399960c9633) log_source='WinEventLog:Sysmon'
      - analytic 'Analytic 2154' (x-mitre-analytic--33c51048-bfa2-431a-a1d9-40fb60248de4) log_source='auditd:SYSCALL'
      - analytic 'Analytic 2279' (x-mitre-analytic--c6a85d88-e62c-4bc2-8210-a8c94705d0f4) log_source='WinEventLog:Sysmon'

  x-mitre-data-component--3551476e-14f5-4e48-a518-e82135329e03
    name='Driver Load'  found_in=enterprise
    referenced by 5 analytic log-source(s):
      - analytic 'Analytic 1932' (x-mitre-analytic--28eb77c1-1834-4b7a-a06f-afebb7f2e756) log_source='WinEventLog:Sysmon'
      - analytic 'Analytic 2272' (x-mitre-analytic--866a9b33-9fd4-4f1a-a44e-dd919f31efc1) log_source='WinEventLog:Sysmon'
      - analytic 'Analytic 2269' (x-mitre-analytic--92483574-b54e-403d-a08b-f6e07a77f963) log_source='WinEventLog:Sysmon'
      - analytic 'Analytic 2261' (x-mitre-analytic--c1ff324d-8321-49f5-95db-db99c888bb2c) log_source='WinEventLog:Sysmon'
      - analytic 'Analytic 2167' (x-mitre-analytic--ee5da023-236b-4c86-b228-9280aa402119) log_source='WinEventLog:Sysmon'

  x-mitre-data-component--746f095a-f84c-4ccc-90a5-c7caa5c100a2
    name='Firewall Metadata'  found_in=enterprise
    referenced by 1 analytic log-source(s):
      - analytic 'Analytic 2267' (x-mitre-analytic--13d41f06-6c14-4b45-8c66-bc0fdd878419) log_source='WinEventLog:Security'

  x-mitre-data-component--d2ff4b56-8351-4ed8-b0fb-d8605366005f
    name='Firewall Rule Modification'  found_in=enterprise
    referenced by 2 analytic log-source(s):
      - analytic 'Analytic 2266' (x-mitre-analytic--869e2789-fd07-4bda-8d59-a6fc6c4ee96f) log_source='WinEventLog:Security'
      - analytic 'Analytic 2264' (x-mitre-analytic--d6db8902-24b1-4e69-bc3d-78585c78a5d4) log_source='WinEventLog:Security'
Lingua principale
Python
Stelle
701
Fork
150
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di mitre-attack/attack-stix-data

Tutte le issue di mitre-attack/attack-stix-data

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.