[Bug] Technique/tactic seems malformed

Open
#186 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
python
Domain
tooling

Research direction

Start at the ToExcel exporter entry point and inspect the shown malformed-technique branch, especially how T1078.004 and its tactic are matched against the layer data. Reproduce the issue with the supplied layer and local enterprise-attack JSON. Done means exporting the layer includes T1078.004 in the output without the malformed warning.

Written by the indexing model from the issue text.

Description

bug

Expected Behavior

Using the exporters such as Excel or SVG using a local json file like https://github.com/mitre-attack/attack-stix-data/blob/master/enterprise-attack/enterprise-attack.json source should retrieve the proper data and produce the expected exported output with an output layer.

Actual Behavior

Every technique and subtechnique I was testing worked perfectly expect for this one : T1078.004

The error message is :
WARNING! Technique/Tactic T1078.004/(none) seems malformed. Skipping...

Steps to Reproduce the Problem

from mitreattack.navlayers.core import Layer
from mitreattack.navlayers.exporters.to_excel import ToExcel

lay = Layer()
lay.from_file("C:path_to_layer.json")

t2 = ToExcel(domain='enterprise', source='local', resource='path_to_enterprise-attack.json')
t2.to_xlsx(layerInit=lay, filepath="demo.xlsx")

The layer i'm using is

{
    "name": "example layer",
    "domain": "enterprise-attack",
    "description": "demo xlsx",
    "versions": {
        "layer": "4.5",
        "attack": "16.1",
        "navigator": "5.1.0"
    },
    "filters": {
        "platforms": [
            "Windows",
            "macOS"
        ]
    },
    "sorting": 2,
    "layout": {
        "layout": "side",
        "showID": true,
        "showName": true,
        "showAggregateScores": true,
        "countUnscored": true,
        "aggregateFunction": "average",
        "expandedSubtechniques": "annotated"
    },
    "hideDisabled": false,
    "techniques": [
        {
            "techniqueID": "T1078",
            "color": "#00FF00",
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "comment": "https://attack.mitre.org/techniques/T1078/004/",
            "color": "#00FF00"
        }
    ],
    "gradient": {
        "colors": [
            "#ff6666",
            "#ffe766",
            "#8ec843"
        ],
        "minValue": 0,
        "maxValue": 100
    },
    "legendItems": [
        {
            "label": "Legend Item Label",
            "color": "#FF00FF"
        }
    ],
    "showTacticRowBackground": true,
    "tacticRowBackground": "#dddddd",
    "selectTechniquesAcrossTactics": false,
    "selectSubtechniquesWithParent": false,
    "selectVisibleTechniques": false,
    "metadata": [
        {
            "name": "layer metadata 1",
            "value": "layer metadata 1 value"
        },
        {
            "name": "layer metadata 2",
            "value": "layer metadata 2 value"
        }
    ]
}

Possible Solution

The problem is appearing here

                else:
                    parents = [x for x in layer.layer.techniques if x.techniqueID == tech.techniqueID.split(".")[0]]
                    if tech.tactic:
                        parents = [x for x in parents if x.tactic == tech.tactic]
                    if all([True if not x.showSubtechniques else False for x in parents]):
                        print(
                            "NOTE! Technique/Tactic " + tech.techniqueID + "/" + tac + " does not appear "
                            "to be visible in the matrix. Its parent appears to be hiding it."
                        )
                    else:
                        print(
                            "WARNING! Technique/Tactic " + tech.techniqueID + "/" + tac + " seems malformed. "
                            "Skipping..."
                        )
Dominant language
HTML
Stars
743
Forks
176
PR merge metrics
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from mitre-attack/mitreattack-python

All issues in mitre-attack/mitreattack-python

Similar issues

More DevTools issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.