Open l50 opened 1 year ago
I see two ways of implementing this with slight differences. The first one could be done as
Translator
funcOr another way could be implemented as
Loader
class to read Atomic TTP YAMLsTTP
structure (which is pretty lightweight) with all the Steps
(aka Translator
logic)TTP
steps for the structure in memoryBoth ways are prone to errors on any ART YAML format changes. Both ways could be unit-tested. Both ways provide seamless UX -- "it just works" with all the TTPs provided by ART. The first way could be implemented as a stand-alone program as well. The second way brings extra responsibility to the TTPForge binary which might be unnecessary.
I think we should follow the Technique class to examine how to build parser for Atomic Red Team yaml definitions
Implementation PR
No response
Reference Issues
No response
Summary
We need to figure out a way to ingest and use TTPs from Atomic Red Team
Basic Example
Drawbacks
Could be complicated.
Unresolved questions
Do we want to create a transform function to consume ART or Nuclei "TTPs" into our YAML format? This could save us a lot of heartburn.
Do we want it to be part of the forge codebase or do we want to figure out a modular attachment for this functionality?