center-for-threat-informed-defense / security-stack-mappings

🚨ATTENTION🚨 The Security Stack Mappings have migrated to the Center’s Mappings Explorer project. See README below. This repository is kept here as an archive.
https://center-for-threat-informed-defense.github.io/mappings-explorer/
Apache License 2.0
379 stars 64 forks source link

Consider Using Technique Comments (Instead of Metadata) for Individual Control Mappings #160

Open bajzekm opened 2 years ago

bajzekm commented 2 years ago

ATT&CK Navigator doesn't let users make changes to items in the metadata field for a particular technique like it would for a technique's comments field, and mapping comments are currently stored in a comment subsection of metadata, making them read only and more difficult to view because hover is required, which can make long comments fall off the screen.

At the platform level, mappings can't easily go into comments because techniques can have multiple mappings, but we should consider treating individual control mappings differently and using that field to make it easier for users to interact with the comments.

For further context, the tooltips in question (including comments and metadata) are populated here: https://github.com/mitre-attack/attack-navigator/blob/c196efda36dd6d209ac2f5b8651c66e9901cf74a/nav-app/src/app/matrix/technique-cell/tooltip/tooltip.component.html

Thanks to Jen Burns for bringing this issue to our attention and suggesting the fix.