os-threat / Stix-ORM

GNU Affero General Public License v3.0
4 stars 0 forks source link

Load Mitre ATT&CK Data #18

Open brettforbes opened 1 year ago

brettforbes commented 1 year ago

First get:

  1. Attack delete working #8 Note: The collection must be deleted first, then all other objects, and finally the marking and identity are to be deleted
  2. Cyclical working #6

Then add the loading of attack data to the typedb initialisation routine.

If ""ATT&CK"=True" in the import_types config object then:

  1. Load the Attack schema
  2. Load the Attack data based on the "ATT&CK_Versions" and "ATT&CK_Domains" variables

To load the ATT&CK data, pull down the collection index at this address https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/index.json

Parse this collection index and select the collection's that correspond to the version ("ATT&CK_Versions") and domain ("ATT&CK_Domains") in the config file.

As an example, if v12.1 is the version, and enterprise, mobile and ics are the selected domains, access these from the collection index and load each collection.

Warning: Each collection will have cyclical records, in particular an identity and marking that is referenced by every object, and the collection that has a pointer to every object, including the identity and marking object, as well as referring to them in fields.

Using the instructions in #6 , then manually load everything in this order:

  1. First load the independent parts of the identity and marking objects
  2. Second, load the dependent parts of the identity and marking objects
  3. Third, load all of the other objects except for the collection
  4. Fourth, load the collection last

On Delete, the order of deletion must be in reverse

brettforbes commented 10 months ago

should be working properly now, some subtle errors fixed