Attack Navigator not populating all techniques from playbook & always showing T1001 when selecting View related plays

[0nnyx]

1. My playbook rules include for example "Suspicious Double Extension" but the Navigator does not show 1566 highlighted.

Same thing for "DNS RCE CVE-2020-1350" matching T1190, T1569 and not highlighted on the Navigator

2. Right click 'View related plays' on Attack navigator systematically opens playbook with a filter for T1001 instead of putting the proper identifier.

[defensivedepth]

Hello there!

What version are you running?

Also, are Suspicious Double Extension and DNS RCE CVE-2020-1350 Active?

[0nnyx]

Using 2.3.10 and both plays are Active in Playbook of course.

[0nnyx]

Another example: I have also the rules "Exploit for CVE-2017-8759" & "Antivirus Exploitation Framework Detection" both matching T1203 but "Exploitation for Client Execution" also not showing highlighted on Navigator.
However, my Navigator is not completely empty and shows some techniques highlighted, hence no clue why some show up while others don't.

[defensivedepth]

Thanks, I have created an issue to track this further.

#2067

[esurharun]

There is also same issue on 2.4.30. Playbook does not populate Playbook rules and does not allow us to change background colors manually anyhow.

Is there any update for this?

[defensivedepth]

@esurharun Please create a new Discussion next time - this Discussion is for 2.3

There is a known issue with Navigator on 2.4 - here is where we are tracking it: #11380