Invalid Uuid inside Id of collection element in enterprise file

rivantsov commented 2 years ago

enterprise-attack file, element x-mitre-collection:

        "type": "x-mitre-collection",
        "id": "x-mitre-collection--23320f4-22ad-8467-3b73-ed0c869a12838",

Uuid inside Id is invalid - the first segment is 7-char long, should be 8

isaisabel commented 2 years ago

Hi @rivantsov,

Thanks for pointing this out. There are actually two issues with the UUID in question:

As you pointed out, it's the wrong length
The 1st digit of the 3rd set of random characters needs to be a 4 (e.g xxxxxxxx-xxxx-4xxx-xxxx-xxxxxxxxxxxx) to encode the type -- according to the STIX spec STIX IDs must be UUID-4s.

We'll probably need to patch the ID in the collections and collection index. However, this is likely to have some ripple-down effects to ATT&CK Workbench since it will no longer be able to determine if a user has already downloaded the Enterprise collection if the ID changes. It might take us a bit to figure out a workaround for that issue.

isaisabel commented 2 years ago

This was fixed alongside the release of ATT&CK v10. The enterprise ID was changed to x-mitre-collection--402e24b4-436e-4936-b19b-2038648f489. ATT&CK Workbench (which is the only tool we maintain that ingests these IDs) should be able to remap the old collection ID to the new one automatically in version 1.1.0.

mitre-attack / attack-stix-data

Invalid Uuid inside Id of collection element in enterprise file #3