You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Dec 11, 2023. It is now read-only.
Copy file name to clipboardExpand all lines: CHANGELOG.md
+4Lines changed: 4 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,3 +1,7 @@
1
+
# v1.8 - 15 December 2020
2
+
## Improvements
3
+
- Updated Layer library to support ATT&CK Navigator Layer format version 4.1.
4
+
1
5
# v1.7 - 27 October 2020
2
6
## Improvements
3
7
- Removed pre-ATT&CK domain from scripts to support migration of that content to enterprise tactics. See issue [#36](https://github.com/mitre-attack/attack-scripts/issues/36).
Copy file name to clipboardExpand all lines: layers/README.md
+37-35Lines changed: 37 additions & 35 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,18 +1,18 @@
1
1
# layers
2
2
3
-
This folder contains modules and scripts for working with ATT&CK Navigator layers. ATT&CK Navigator Layers are a set of annotations overlayed on top of the ATT&CK Matrix. For more about ATT&CK Navigator layers, visit the ATT&CK Navigator repository. The core module allows users to load, validate, manipulate, and save ATT&CK layers. A brief overview of the components can be found below. All scripts adhere to the MITRE ATT&CK Navigator Layer file format, [version 4.0](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4.md), but will accept legacy [version 3.0](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv3.md) layers, upgrading them to version 4.
3
+
This folder contains modules and scripts for working with ATT&CK Navigator layers. ATT&CK Navigator Layers are a set of annotations overlaid on top of the ATT&CK Matrix. For more about ATT&CK Navigator layers, visit the ATT&CK Navigator repository. The core module allows users to load, validate, manipulate, and save ATT&CK layers. A brief overview of the components can be found below. All scripts adhere to the MITRE ATT&CK Navigator Layer file format, [version 4.1](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4_1.md), but will accept legacy [version 3.0](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv3.md) layers, upgrading them to version 4.1.
4
4
5
5
#### Core Modules
6
6
| script | description |
7
7
|:-------|:------------|
8
-
|[filter](core/filter.py)| Implements a basic [filter object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4.md#filter-object-properties). |
9
-
|[gradient](core/gradient.py)| Implements a basic [gradient object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4.md#gradient-object-properties). |
8
+
|[filter](core/filter.py)| Implements a basic [filter object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4_1.md#filter-object-properties). |
9
+
|[gradient](core/gradient.py)| Implements a basic [gradient object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4_1.md#gradient-object-properties). |
10
10
|[layer](core/layer.py)| Provides an interface for interacting with core module's layer representation. A further breakdown can be found in the corresponding [section](#Layer) below. |
11
-
|[layout](core/layout.py)| Implements a basic [layout object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4.md#layout-object-properties). |
12
-
|[legenditem](core/legenditem.py)| Implements a basic [legenditem object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4.md#legenditem-object-properties). |
13
-
|[metadata](core/metadata.py)| Implements a basic [metadata object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4.md#metadata-object-properties). |
14
-
|[technique](core/technique.py)| Implements a basic [technique object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4.md#technique-object-properties). |
15
-
|[versions](core/versions.py)| Impelments a basic [versions object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4.md#versions-object-properties).|
11
+
|[layout](core/layout.py)| Implements a basic [layout object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4_1.md#layout-object-properties). |
12
+
|[legenditem](core/legenditem.py)| Implements a basic [legenditem object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4_1.md#legenditem-object-properties). |
13
+
|[metadata](core/metadata.py)| Implements a basic [metadata object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4_1.md#metadata-object-properties). |
14
+
|[technique](core/technique.py)| Implements a basic [technique object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4_1.md#technique-object-properties). |
15
+
|[versions](core/versions.py)| Impelments a basic [versions object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4_1.md#versions-object-properties).|
16
16
#### Manipulator Scripts
17
17
| script | description |
18
18
|:-------|:------------|
@@ -22,14 +22,14 @@ This folder contains modules and scripts for working with ATT&CK Navigator layer
22
22
| script | description |
23
23
|:-------|:------------|
24
24
|[to_excel](exporters/to_excel.py)| Provides a means by which to export an ATT&CK Layer to an excel file. A further breakdown can be found in the corresponding [section](#to_excel.py) below. |
25
-
|[to_svg](exporters/to_svg.py)| Provides a means by which to export an ATT&CK layer to an svg image file. A further breakdown can be found in the corresponding [section](#to_svg.py) below. This file also contains the `SVGConfig` object that can be used to configure the SVG export.|
25
+
|[to_svg](exporters/to_svg.py)| Provides a means by which to export an ATT&CK layer to an svg image file. A further breakdown can be found in the corresponding [section](#to_svg.py) below. This file also contains the `SVGConfig` object that can be used to configure the SVG export.|
26
26
##### Utility Modules
27
27
| script | description |
28
28
|:-------|:------------|
29
29
|[excel_templates](exporters/excel_templates.py)| Provides a means by which to convert a matrix into a clean excel matrix template. |
30
30
|[matrix_gen](exporters/matrix_gen.py)| Provides a means by which to generate a matrix from raw data, either from the ATT&CK TAXII server or from a local STIX Bundle. |
31
31
|[svg_templates](exporters/svg_templates.py)| Provides a means by which to convert a layer file into a marked up svg file. |
32
-
|[svg_objects](exporters/svg_objects.py)| Provides raw templates and supporting functionality for generating svg objects. |
32
+
|[svg_objects](exporters/svg_objects.py)| Provides raw templates and supporting functionality for generating svg objects. |
33
33
##### Command Line Tools
34
34
| script | description |
35
35
|:-------|:------------|
@@ -45,7 +45,7 @@ The Layer class provides format validation and read/write capabilities to aid in
45
45
| x.from_file(_filepath_) | Loads an ATT&CK layer from a file location specified by the _filepath_. |
46
46
| x.to_file(_filepath_) | Saves the current state of the loaded ATT&CK layer to a json file denoted by the _filepath_. |
47
47
| x.to_dict() | Returns a representation of the current ATT&CK layer object as a dictionary. |
48
-
| x.to_str() | Returns a representation of the current ATT&CK layer object as a string representation of a dictionary. |
48
+
| x.to_str() | Returns a representation of the current ATT&CK layer object as a string representation of a dictionary. |
49
49
50
50
#### Example Usage
51
51
@@ -57,10 +57,11 @@ example_layer3_dict = {
57
57
}
58
58
59
59
example_layer4_dict = {
60
-
"name": "layer v4 example",
60
+
"name": "layer v4.1 example",
61
61
"versions" : {
62
-
"layer" : "4.0",
63
-
"navigator": "4.0"
62
+
"attack": "8",
63
+
"layer" : "4.1",
64
+
"navigator": "4.1"
64
65
},
65
66
"domain": "enterprise-attack"
66
67
}
@@ -88,7 +89,7 @@ Layerops.py provides the LayerOps class, which is a way to combine layer files i
88
89
```python
89
90
x = LayerOps(score=score, comment=comment, enabled=enabled, colors=colors, metadata=metadata, name=name, desc=desc, default_values=default_values)
90
91
```
91
-
92
+
92
93
Each of the _inputs_ takes a lambda function that will be used to combine technique object fields matching the parameter. The one exception to this is _default_values_, which is an optional dictionary argument containing default values to provide the lambda functions if techniques of the combined layers are missing them.
# Example 1) Build a LayerOps object that takes a list and averages scores across the layers
114
-
lo = LayerOps(score=lambdax: sum(x) /len(x),
115
-
name=lambdax: x[1],
115
+
lo = LayerOps(score=lambdax: sum(x) /len(x),
116
+
name=lambdax: x[1],
116
117
desc=lambdax: "This is an list example") # Build LayerOps object
117
118
out_layer = lo.process([demo, demo2]) # Trigger processing on a list of demo and demo2 layers
118
119
out_layer.to_file("C:\demo_layer1.json") # Save averaged layer to file
119
120
out_layer2 = lo.process([demo, demo2, demo3]) # Trigger processing on a list of demo, demo2, demo3
120
121
visual_aid = out_layer2.to_dict() # Retrieve dictionary representation of processed layer
121
122
122
123
# Example 2) Build a LayerOps object that takes a dictionary and averages scores across the layers
123
-
lo2 = LayerOps(score=lambdax: sum([x[y] for y in x]) /len([x[y] for y in x]),
124
-
color=lambdax: x['b'],
124
+
lo2 = LayerOps(score=lambdax: sum([x[y] for y in x]) /len([x[y] for y in x]),
125
+
color=lambdax: x['b'],
125
126
desc=lambdax: "This is a dict example") # Build LayerOps object, with lambda
126
127
out_layer3 = lo2.process({'a': demo, 'b': demo2}) # Trigger processing on a dictionary of demo and demo2
127
128
dict_layer = out_layer3.to_dict() # Retrieve dictionary representation of processed layer
@@ -147,23 +148,23 @@ out_layer6.to_file("C:\demo_layer6.json") # Save combined co
147
148
```
148
149
149
150
## to_excel.py
150
-
to_excel.py provides the ToExcel class, which is a way to export an existing layer file as an Excel
151
-
spreadsheet. The ToExcel class has an optional parameter for the initialization function, that
152
-
tells the exporter what data source to use when building the output matrix. Valid options include using live data from cti-taxii.mitre.org or using a local STIX bundle.
151
+
to_excel.py provides the ToExcel class, which is a way to export an existing layer file as an Excel
152
+
spreadsheet. The ToExcel class has an optional parameter for the initialization function, that
153
+
tells the exporter what data source to use when building the output matrix. Valid options include using live data from cti-taxii.mitre.org or using a local STIX bundle.
153
154
154
155
##### ToExcel()
155
156
```python
156
157
x = ToExcel(domain='enterprise', source='taxii', local=None)
157
158
```
158
-
The ToExcel constructor takes domain, server, and local arguments during instantiation. The domain can
159
+
The ToExcel constructor takes domain, server, and local arguments during instantiation. The domain can
159
160
be either `enterprise` or `mobile`, and can be pulled directly from a layer file as `layer.domain`. The source argument tells the matrix generation tool which data source to use when building the matrix. `taxii` indicates that the tool should utilize the official ATT&CK Taxii Server (`cti-taxii`) when building the matrix, while the `local` option indicates that it should use a local bundle respectively. The local argument is only required if the source is set to `local`, in which case it should be a path to a local stix bundle.
160
161
161
162
##### .to_xlsx() Method
162
163
```python
163
164
x.to_xlsx(layer=layer, filepath="layer.xlsx")
164
165
```
165
-
The to_xlsx method exports the layer file referenced as `layer`, as an excel file to the
166
-
`filepath` specified.
166
+
The to_xlsx method exports the layer file referenced as `layer`, as an excel file to the
to_svg.py provides the ToSvg class, which is a way to export an existing layer file as an SVG image file. The ToSvg class, like the ToExcel class, has an optional parameter for the initialization function, that
185
-
tells the exporter what data source to use when building the output matrix. Valid options include using live data from cti-taxii.mitre.org or using a local STIX bundle.
185
+
to_svg.py provides the ToSvg class, which is a way to export an existing layer file as an SVG image file. The ToSvg class, like the ToExcel class, has an optional parameter for the initialization function, that
186
+
tells the exporter what data source to use when building the output matrix. Valid options include using live data from cti-taxii.mitre.org or using a local STIX bundle.
186
187
187
188
##### ToSvg()
188
189
```python
@@ -195,7 +196,7 @@ The ToSvg constructor, just like the ToExcel constructor, takes domain, server,
195
196
y = SVGConfig(width=8.5, height=11, headerHeight=1, unit="in", showSubtechniques="expanded",
The SVGConfig object is used to configure how an SVG export behaves. The defaults for each of the available values can be found in the declaration above, and a brief explanation for each field is included in the table below. The config object should be provided to the ToSvg object during instantiation, but if values need to be updated on the fly, the currently loaded configuration can be interacted with at `ToSvg().config`. The configuration can also be populated from a json file using the `.load_from_file(filename="path/to/file.json")` method, or stored to one using the `.save_to_file(filename="path/to/file.json)` method.
201
202
@@ -204,10 +205,10 @@ The SVGConfig object is used to configure how an SVG export behaves. The default
0 commit comments