search

pan-unit42 / playbook_viewer

MIT License
168 stars 43 forks source link

Playbook creation #8

Closed jordisk closed 5 years ago

jordisk commented 5 years ago

I have added a new json file (stix2 format) to the playbooks folder and modified the html to show it, but nothing is displayed.

Does you playbook viewer support adding new playbooks or only the ones created by you? As mentioned in your repo, you use att&ck framework and STIX 2, but exporting a MISP event maped to att&ck framework in stix 2 seems to not work at all.

Many thanks

eiyuki commented 5 years ago

A Playbook is a STIX 2.0 JSON file with a specific structure. I have added some documentation and examples that can be seen here

MISP's exporter does not know the structure of a Playbook. While the file is valid STIX 2.0 JSON, it is not a valid Playbook.

It may be possible to map this to a Playbook. However, I took a brief look at MISP, and was not sure which options or plugins were used to export.