[Request] Can you add attackToExcel.get_stix_data_from( "/path/to/export/folder") to make loading data much faster? Or some other more efficient cache file format?
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- python
- Domain
- data-engineering
Research direction
Start with the usage example and the attackToExcel.export and get_stix_data entry points, then review how stixToDf.techniquesToDf consumes the loaded data. Compare the proposed folder import and Parquet alternatives; done should include a documented, efficient reload path without requiring users to wait for repeated STIX parsing.
Written by the indexing model from the issue text.
Description
Is your feature request related to a problem?
The example from the usage page we've been using takes an extremely long time to load.
Describe the solution you'd like
Just make it a little more clear (in the basic usage example) how we can not only export, but cache and import the att&ck matrix data rather than slowly loading it.
Describe alternatives you've considered
There doesn't seem to be one since the documentation only mentions an export feature, not import.
Additional context
import mitreattack.attackToExcel.attackToExcel as attackToExcel
import mitreattack.attackToExcel.stixToDf as stixToDf
# download and parse ATT&CK STIX data
# SUGGESTED ADDITION / PSEUDO CODE:
attackToExcel.export("enterprise-attack", "v8.1", "/path/to/export/folder")
# instead of:
# attackdata = attackToExcel.get_stix_data("enterprise-attack")
# allow:
attackdata = attackToExcel.get_stix_data_from( "/path/to/export/folder")
# END ADDITION
# get Pandas DataFrames for techniques, associated relationships, and citations
techniques_data = stixToDf.techniquesToDf(attackdata, "enterprise-attack")
# show T1102 and sub-techniques of T1102
techniques_df = techniques_data["techniques"]
print(techniques_df[techniques_df["ID"].str.contains("T1102")]["name"])
And I don't really know if exporting as excel is the most efficient way to cache the data, probably not, but it seems to be the format supported. My only goal is to get the data into a DataFrame as efficiently as possible instead of having to go take a 5 minute coffee break to wait every time I restart my Jupyter kernel.
We're going to be solving this by adding some code to use Apache's Parquet to store the DataFrame efficiently, but that is not something that would make sense as a PR in a library designed for converting to Excel. That said, people shouldn't need to invent a caching solution for this, in my opinion. It would make sense to support it by default when the library takes 3-5 minutes to load into a DataFrame.
Like I said, I don't know if it really fits into the library since it's named to be an excel conversion tool, but I'm thinking something like:
attackToExcel.export_parquet("enterprise-attack", "v8.1", "/path/to/export/file")
attackdata = attackToExcel.import_parquet("/path/to/export/file")
techniques_data = stixToDf.techniquesToDf(attackdata, "enterprise-attack")
- Dominant language
- HTML
- Stars
- 743
- Forks
- 176
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from mitre-attack/mitreattack-python
-
bug
Difficulty 3/5 1-2 days Newbie friendliness 35/100
mitre-attack/mitreattack-python#207 · 1 comment ·
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
mitre-attack/mitreattack-python#188 · 1 comment ·
-
bug
Difficulty 3/5 1-2 days Newbie friendliness 35/100
-
bug
Difficulty 3/5 1-2 days Newbie friendliness 35/100
mitre-attack/mitreattack-python#183 · 2 comments · 1 reaction ·
-
[Request] OWL export Open
Difficulty 5/5 Over a week Newbie friendliness 25/100
All issues in mitre-attack/mitreattack-python
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
cisagov/cyhy-reports#149 · 3 comments ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
open-compass/VLMEvalKit#1698 ·