Build “Sequence Builder” UI for TTP Ordering After Accept/Reject Step

[KadeMorton]

What it is

Introduce a new UI after the TTP Accept/Reject screen that allows users to define the order and structure (e.g., fork, merge) of accepted techniques for Attack Flow export.

Why it matters

• Enables user-controlled sequencing for ATT&CK techniques.
• Required for accurate Attack Flow construction and downstream visualization.

Requirements

• Display list of accepted TTPs in read-only mode.
• Provide controls next to each:
  • ↑ (Move Up)
  • ↓ (Move Down)
  • Fork (Split)
  • Merge (Join)
• Allow creation of:
  • Linear flows
  • Fork (1 → many)
  • Merge (many → 1)
• Save flow structure and ordering in associated FlowNode records.

Acceptance Criteria

• User can define flow order using simple controls.
• Fork and merge relationships stored correctly.
• UI works without drag-and-drop or visual canvas (list + buttons).
• Persisted data is queryable for export.

[jecarr]

Agreed to export an unordered list of TTPs as the steps of giving order (flow), and creating 1 → many (vice-versa) connections are all achievable in the Attack Flow Builder (and is its purpose).

If we ever change this thinking and need to add this into Thread's UI,

here is an example .afb file that presents two TTPs with an arrow between them:

{
    "schema": "attack_flow_v2",
    "objects": [
        {
            "id": "flow",
            "properties": [
                [
                    "name",
                    "Jen's Test"
                ],
                [
                    "description",
                    "Jen is learning about Attack Flow."
                ],
                [
                    "author",
                    [
                        [
                            "name",
                            null
                        ],
                        [
                            "identity_class",
                            "individual"
                        ]
                    ]
                ],
                [
                    "scope",
                    "attack-tree"
                ],
                [
                    "created",
                    "2025-07-22T15:45:49.090Z"
                ]
            ],
            "objects": [
                "c14cbe32-d055-4d5c-9a25-8965dd7f8de5",
                "fcff5cd9-edbf-4cc1-8ad5-8a88561b3c2a",
                "43ce66b9-fd35-458a-b557-d2431344cc2d"
            ]
        },
        {
            "id": "action",
            "instance": "fcff5cd9-edbf-4cc1-8ad5-8a88561b3c2a",
            "properties": [
                [
                    "name",
                    "Phishing: Spearphishing Attachment"
                ],
                [
                    "technique_id",
                    "T1566.001"
                ],
                [
                    "technique_ref",
                    "attack-pattern--2e34237d-8574-43f6-aace-ae2915de8597"
                ],
                [
                    "ttp",
                    [
                        [
                            "technique",
                            "T1566.001"
                        ]
                    ]
                ]
            ],
            "anchors": {
                "270": "1a5f6410-0e76-4ec8-81b6-570c65663d7e"
            }
        },
        {
            "id": "action",
            "instance": "43ce66b9-fd35-458a-b557-d2431344cc2d",
            "properties": [
                [
                    "name",
                    "Deobfuscate/Decode Files or Information"
                ],
                [
                    "technique_id",
                    "T1140"
                ],
                [
                    "technique_ref",
                    "attack-pattern--3ccef7ae-cb5e-48f6-8302-897105fbf55c"
                ],
                [
                    "ttp",
                    [
                        [
                            "technique",
                            "T1140"
                        ]
                    ]
                ]
            ],
            "anchors": {
                "90": "87d4699c-ee43-4fd7-bd6e-2407954362cf"
            }
        },
        {
            "id": "dynamic_line",
            "instance": "c14cbe32-d055-4d5c-9a25-8965dd7f8de5",
            "source": "0baf8b0d-988c-4a8f-b689-e6113850ca34",
            "target": "c31e670e-b521-4970-9cd2-02cdf0e762e7",
            "handles": [
                "fa550473-4529-41d5-8b98-14f98b936070"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "0baf8b0d-988c-4a8f-b689-e6113850ca34"
        },
        {
            "id": "generic_latch",
            "instance": "c31e670e-b521-4970-9cd2-02cdf0e762e7"
        },
        {
            "id": "generic_handle",
            "instance": "fa550473-4529-41d5-8b98-14f98b936070"
        },
        {
            "id": "vertical_anchor",
            "instance": "1a5f6410-0e76-4ec8-81b6-570c65663d7e",
            "latches": [
                "0baf8b0d-988c-4a8f-b689-e6113850ca34"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "87d4699c-ee43-4fd7-bd6e-2407954362cf",
            "latches": [
                "c31e670e-b521-4970-9cd2-02cdf0e762e7"
            ]
        }
    ],
    "layout": {
        "fcff5cd9-edbf-4cc1-8ad5-8a88561b3c2a": [
            0,
            -2000
        ],
        "43ce66b9-fd35-458a-b557-d2431344cc2d": [
            0,
            -1600
        ]
    },
    "camera": {
        "x": 0,
        "y": -1600,
        "k": 0.5
    }
}