center-for-threat-informed-defense / tram

TRAM is an open-source platform designed to advance research into automating the mapping of cyber threat intelligence reports to MITRE ATT&CK®.
https://ctid.mitre-engenuity.org/our-work/tram/
Apache License 2.0
418 stars 90 forks source link

REST endpoint for TRAM submitting report and returning TRAM prediction JSON #121

Open watgh opened 2 years ago

watgh commented 2 years ago

As a non-interactive user, I want to submit a report (similar to the upload endpoint) and receive a JSON response equivalent to the JSON export of an annotated report.

This is useful for using TRAM as a service for integration allowing other User Interfaces.

MarkDavidson commented 2 years ago

@watgh - TRAM has a ML pipeline that can run without the webserver component. It's probably halfway to what you need.

You can add reports with:

manage.py pipeline add --file <filename>

But right there's no functionality to export results the same way, but it would be straightforward to add. What do you think?

watgh commented 2 years ago

For integration we actually need to be able to do this from the web interface. But one of our developers whipped out a solution to talk to the endpoints that exists. Once we test it I'll respond and close this ticket. We don't have systems where just anybody can login and access the command line when the prototype is used by a group.

JWeasy commented 5 months ago

@watgh Would you be willing to share the solution?

watgh commented 5 months ago

sorry, its been a while.... solution for what? what exactly are you looking to do? Anything we'd worked on was on a closed network, so the short answer is that I can't just point you at an example. We and some other colleagues were able to upload and download with some scripts using the API. I don't have access right now as I've been out sick for a few days and am working from home. basically if you just look at the web API implementation, you should see what calls you need to make.


From: JWeasy @.> Sent: Thursday, February 8, 2024 12:02 PM To: center-for-threat-informed-defense/tram @.> Cc: watgh @.>; Mention @.> Subject: [EXTERNAL] Re: [center-for-threat-informed-defense/tram] REST endpoint for TRAM submitting report and returning TRAM prediction JSON (Issue #121)

@watgh [github.com]https://urldefense.com/v3/__https://github.com/watgh__;!!NFAdMAnI0yk!DjAIc7XHXoJ1RN98UJf1so_TSvkmAUjdUoiDQS9AzsMQsM6cEHH_eE68ToZG9qjgBYc3jdhh5U5ZgyyLjizdPd1ReZmlgg$ Would you be willing to share the solution?

— Reply to this email directly, view it on GitHub [github.com]https://urldefense.com/v3/__https://github.com/center-for-threat-informed-defense/tram/issues/121*issuecomment-1934555728__;Iw!!NFAdMAnI0yk!DjAIc7XHXoJ1RN98UJf1so_TSvkmAUjdUoiDQS9AzsMQsM6cEHH_eE68ToZG9qjgBYc3jdhh5U5ZgyyLjizdPd2iWEoKUQ$, or unsubscribe [github.com]https://urldefense.com/v3/__https://github.com/notifications/unsubscribe-auth/AWEQ4NBVRYPQXJCK6HQJHZ3YSUAJNAVCNFSM5JZPQC22U5DIOJSWCZC7NNSXTN2JONZXKZKDN5WW2ZLOOQ5TCOJTGQ2TKNJXGI4A__;!!NFAdMAnI0yk!DjAIc7XHXoJ1RN98UJf1so_TSvkmAUjdUoiDQS9AzsMQsM6cEHH_eE68ToZG9qjgBYc3jdhh5U5ZgyyLjizdPd33wZIH9A$. You are receiving this because you were mentioned.Message ID: @.***>

'NOTICE: This email message and all attachments transmitted with it may contain privileged and confidential information, and information that is protected by, and proprietary to, Parsons Corporation, and is intended solely for the use of the addressee for the specific purpose set forth in this communication. If the reader of this message is not the intended recipient, you are hereby notified that any reading, dissemination, distribution, copying, or other use of this message or its attachments is strictly prohibited, and you should delete this message and all copies and backups thereof. The recipient may not further distribute or use any of the information contained herein without the express written authorization of the sender. If you have received this message in error, or if you have any questions regarding the use of the proprietary information contained therein, please contact the sender of this message immediately, and the sender will provide you with further instructions.'

JWeasy commented 5 months ago

@watgh Thanks for the response. Looking to be able to remotely upload a flat file report from a system without interactive login within the web ui.