search

Security-Onion-Solutions / securityonion

Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, and case management. It also includes other tools such as osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.
https://securityonion.net
3.32k stars 514 forks source link

FIX: ATT&CK custom_context_menu_items lead to 404 error #13885

Open mrkruel1337 opened 4 weeks ago

mrkruel1337 commented 4 weeks ago

Description:

When using ATT&CK right clicking to use the custom context menu option and selecting "view related plays" leads to a 404: page not found error message:

Screen Shots:

image

image

Related Config/Code:

/opt/so/conf/navigator/config.json


{
    "versions": [
        {
            "name": "ATT&CK v14",
            "version": "14",
            "domains": [
                {
                    "name": "Enterprise",
                    "identifier": "enterprise-attack",
                    "data": ["assets/so/enterprise-attack.json"]
                }
            ]
        }
    ],

    "custom_context_menu_items": [ {"label": "view related plays","url": "  https://cerberusnet.milwaukeeforge.com/playbook/projects/detection-playbooks/issues?utf8=%E2%9C%93&set_filter=1&sort=id%3Adesc&f%5B%5D=cf_15&op%5Bcf_15%5D=%3D&f%5B%5D=&c%5B%5D=status&c%5B%5D=cf_10&c%5B%5D=cf_13&c%5B%5D=cf_18&c%5B%5D=cf_19&c%5B%5D=cf_1&c%5B%5D=updated_on&v%5Bcf_15%5D%5B%5D=~Technique_ID~"}],

    "default_layers": {
        "enabled": true,
        "urls": ["assets/so/nav_layer_playbook.json"]
    },
...

Suggested Fix:

Update to reference detections if possible or remove custom context menu items: "view related plays"

defensivedepth commented 4 weeks ago

Thanks @mrkruel1337, we are reworking this functionality for the next release.