search

rabobank-cdc / DeTTECT

Detect Tactics, Techniques & Combat Threats
GNU General Public License v3.0
2.04k stars 331 forks source link

Seeing some strangeness #113

Closed etheruler closed 5 months ago

etheruler commented 5 months ago

Hello DeTT&CT Team - I am seeing some strangeness that I do not understand. Is the latest version of DeTTECT okay? Here is what I am seeing...

If I use a locally installed copy of DETTECT from 25-Jan-2024, the command "python dettect.py generic -ds" works fine.

If I use the latest docker version that I pulled down on 13-Mar-2024 and run the same command, I get the error: [!] Cannot connect to MITRE's CTI TAXII server: https://cti-taxii.mitre.org/stix/collections/95ecc380-afe9-11e4-9b6c-751b66dd541e/

If if I use a new locally installed copy of DETTECT fomr 13-Mar-2024, and run the same command, I get the error [!] Cannot connect to MITRE's CTI TAXII server: https://cti-taxii.mitre.org/stix/collections/95ecc380-afe9-11e4-9b6c-751b66dd541e/

At first, I thought I was having proxy or firewall issues, but since one of the application instance ran fine I that ruled out. Any help would be apprecicated.

Thanks...

rubinatorz commented 5 months ago

hi @etheruler

MITRE's TAXII server is down for already a couple of days... I can't help that.

To fix this for now, and also in the future and also to make your runs run faster: you can use the --local-stix-path command line parameter. You can clone the CTI STIX repository (https://github.com/mitre/cti) and use it in DeTT&CT as offline ATT&CK source instead of the TAXII server.

The DeTT&CT code base of January 25 uses the same TAXII server... but probably it's working because of cached data. DeTT&CT caches information from TAXII server in the cache folder, so maybe your January 25 version still has a filled cache folder and thus working.

etheruler commented 5 months ago

Hi Ruben - Thank you for the information. It explains what I am seeing and I'm glad to hear that it's not a DeTTeCT issue. I may look into cloning the CTI STIX Repository and working offline. It may be useful as a backup option when the CTI site goes down again.

Best Regards, e

On Thu, Mar 14, 2024 at 3:34 PM Ruben Bouman @.***> wrote:

hi @etheruler https://github.com/etheruler

MITRE's TAXII server is down for already a couple of days... I can't help that.

To fix this for now, and also in the future and also to make your runs run faster: you can use the --local-stix-path command line parameter. You can clone the CTI STIX repository (https://github.com/mitre/cti) and use it in DeTT&CT as offline ATT&CK source instead of the TAXII server.

The DeTT&CT code base of January 25 uses the same TAXII server... but probably it's working because of cached data. DeTT&CT caches information from TAXII server in the cache folder, so maybe your January 25 version still has a filled cache folder and thus working.

— Reply to this email directly, view it on GitHub https://github.com/rabobank-cdc/DeTTECT/issues/113#issuecomment-1998287103, or unsubscribe https://github.com/notifications/unsubscribe-auth/AOET64AZ4LEGH7ZOPBICMHDYYH3VVAVCNFSM6AAAAABEWS5YBSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSOJYGI4DOMJQGM . You are receiving this because you were mentioned.Message ID: @.***>