center-for-threat-informed-defense / security-stack-mappings

🚨ATTENTION🚨 The Security Stack Mappings have migrated to the Center’s Mappings Explorer project. See README below. This repository is kept here as an archive.
https://center-for-threat-informed-defense.github.io/mappings-explorer/
Apache License 2.0
379 stars 64 forks source link

`mapping_cli.py rebuild_mappings` is failing #163

Closed mehaase closed 2 years ago

mehaase commented 2 years ago

This command seems to be broken based on changes in ATT&CK v10 or v11:

./mapping_cli.py rebuild_mappings --mapping-dir path/to/mappings --skip-validation
  File "/Volumes/Code/ctid/security-stack-mappings/tools/./mapping_cli.py", line 279, in <module>
    args.func(args)
  File "/Volumes/Code/ctid/security-stack-mappings/tools/./mapping_cli.py", line 162, in rebuild_mappings
    mapping_driver.rebuild_mappings(args.skip_validation, args.skip_attack)
  File "/Volumes/Code/ctid/security-stack-mappings/tools/mapping_driver.py", line 92, in rebuild_mappings
    self.mapping_db.init_database(self.mapping_files, tags, skip_attack)
  File "/Volumes/Code/ctid/security-stack-mappings/tools/db/database.py", line 32, in init_database
    self.build_attack_database()
  File "/Volumes/Code/ctid/security-stack-mappings/tools/db/database.py", line 216, in build_attack_database
    technique = self.session.query(Technique).filter_by(attack_id=technique_id).one()
  File "/Volumes/Code/ctid/security-stack-mappings/tools/venv/lib/python3.9/site-packages/sqlalchemy/orm/query.py", line 3500, in one
    raise orm_exc.NoResultFound("No row was found for one()")
sqlalchemy.orm.exc.NoResultFound: No row was found for one()

The root cause is this filter on x_mitre_is_subtechnique:

        techniques = self.tc_src.query([
            Filter('type', '=', 'attack-pattern'),
            Filter('kill_chain_phases.phase_name', '=', tactic_name),
            Filter('kill_chain_phases.kill_chain_name', '=', 'mitre-attack'),
            Filter('x_mitre_is_subtechnique', '=', False)
        ])

Manually inspecting the v11 STIX data, I think some techniques do not have the x_mitre_is_subtechnique attribute at all.