search

center-for-threat-informed-defense / attack-flow

Attack Flow helps executives, SOC managers, and defenders easily understand how attackers compose ATT&CK techniques into attacks by developing a representation of attack flows, modeling attack flows for a small corpus of incidents, and creating visualization tools to display attack flows.
https://ctid.io/attack-flow
Apache License 2.0
527 stars 84 forks source link

Publishing quality attack flow diagrams #42

Closed curious-attempt-bunny closed 2 years ago

curious-attempt-bunny commented 2 years ago

Related to https://github.com/center-for-threat-informed-defense/attack-flow/issues/40, how does the community use the attack flow JSON files to publish quality diagrams, such as this one?

Are you able to share what tooling was used [to generate this]? Edit (opening question is still valid): Found the answer. They were manually(?) generated drawio diagrams (e.g. https://github.com/center-for-threat-informed-defense/attack-flow/blob/main/data/action-object-tesla.drawio).

image

curious-attempt-bunny commented 2 years ago

For reference, here's what the attack-flow-example looks like via the current graphviz script:

cd ~/Downloads
curl https://raw.githubusercontent.com/center-for-threat-informed-defense/attack-flow/main/schema/attack-flow-example.json -O -L
cd ~/Downloads/attack-flow/src
python3 -m attack_flow.scripts.graphviz ~/Downloads/attack-flow-example.json ~/Downloads/attack-flow-example.dot
dot ~/Downloads/attack-flow-example.dot -Tpng -O

attack-flow-example dot

mehaase commented 2 years ago

Hi @curious-attempt-bunny, the Tesla diagram was created in Visio early in the life of the project, before the other tooling existed. We have been primarily using Attack Flow Builder to visualize the flows, and I agree that current graphviz output is disappointing. Thank you for the PR!

lcarson-2002 commented 2 years ago

So here's the "Agent Tesla" sample output from the original graphviz.py, included in the 1.0.0 release

Screen Shot 2022-05-18 at 10 43 32 AM

Then after I edited the Graphviz.py (in post #40) to use the Asset State for the label, I get this output, which is arguably more usable... Screen Shot 2022-05-18 at 10 49 05 AM

Finally, I see no value in the "http://flow-1" Oval at the top, so I manually edit the DOT file and comment out all of the flows from that oval. Okay, now we're getting somewhere, this is starting to look like useful output... Screen Shot 2022-05-18 at 10 55 28 AM

For reference here's my current (modified) version of graphviz.py graphviz.py.txt