You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Dec 11, 2023. It is now read-only.
Copy file name to clipboardExpand all lines: CHANGELOG.md
+8-1Lines changed: 8 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,3 +1,10 @@
1
+
# v1.5.1 - 27 July 2020
2
+
## New Scripts
3
+
- Added [layer to excel](https://github.com/mitre-attack/attack-scripts/tree/master/layers#to_excelpy) converter. See issue [#25](https://github.com/mitre-attack/attack-scripts/issues/25).
4
+
## Improvements
5
+
- Updated README to better describe repo contents.
6
+
- Removed outdated detection training. See issue [#37](https://github.com/mitre-attack/attack-scripts/issues/37).
7
+
1
8
# v1.5 - 8 July 2020
2
9
## New Scripts
3
10
Added scripts used to generate the [sample layers in the ATT&CK Navigator repository](https://github.com/mitre-attack/attack-navigator/tree/develop/layers/data/samples). See issue [#21](https://github.com/mitre-attack/attack-scripts/issues/21) and [the sample layer README](scripts/layers/samples/README.md) for more details. The following scripts were added:
@@ -16,7 +23,7 @@ Added scripts used to generate the [sample layers in the ATT&CK Navigator reposi
16
23
## Fixes
17
24
- Fixed bug in LayerOps causing issues with cross-tactic techniques, as well as a bug where a score lambda could affect the outcome of other lambdas.
18
25
19
-
# v1.4 - 5 May 2020
26
+
# V1.4 - 5 May 2020
20
27
## New Scripts
21
28
- Added Layers folder with utility scripts for working with [ATT&CK Navigator](https://github.com/mitre-attack/attack-navigator) Layers. See the Layers [README](layers/README.md) for more details. See issues [#2](https://github.com/mitre-attack/attack-scripts/issues/2) and [#3](https://github.com/mitre-attack/attack-scripts/issues/3).
Copy file name to clipboardExpand all lines: README.md
+4-13Lines changed: 4 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,9 +1,9 @@
1
1
# attack-scripts
2
2
3
-
This repository is intended to provide a library of functions to improve users' interactions with ATT&CK content. In addition, it will provide one-off scripts
4
-
for processing and visualizing ATT&CK content — See [the scripts folder](scripts) for more details.
5
-
6
-
Note: this repository is a work in progress. In the coming months we will be adding additional functionalities as well as soliciting scripts from ATT&CK users — see [contributing to attack-scripts](CONTRIBUTING.md).
3
+
This repository contains various tools and utilities for working with ATT&CK content.
4
+
- the [scripts](scripts) folder contains one-off scripts for processing and visualizing ATT&CK content.
5
+
- the [scripts/layers/samples](scripts/layers/samples) folder contains one-off scripts demonstrating the generation of ATT&CK Navigator layers from ATT&CK data. The outputs of these scripts can also be found on the [ATT&CK Navigator repository](https://github.com/mitre-attack/attack-navigator/tree/master/layers/data/samples).
6
+
-the [layers](layers) folder contains a collection of modules and scripts for working with [ATT&CK Navigator](https://github.com/mitre-attack/attack-navigator) layers.
7
7
8
8
## Requirements
9
9
-[python3](https://www.python.org/)
@@ -13,15 +13,6 @@ Note: this repository is a work in progress. In the coming months we will be add
13
13
2. Activate the environment: `source env/bin/activate`
14
14
3. Install requirements into the virtual environment: `pip3 install -r requirements.txt`
15
15
16
-
## Layers
17
-
This section of the repository contains a collection of modules and scripts for working with ATT&CK Navigator layers. More information about the contents of this section can be found [here](https://github.com/mitre-attack/attack-scripts/blob/master/layers/README.md).
This repository also contains Jupyter notebooks and other material for ATT&CK training. The `trainings` directory has that content, which can be launched via Binder. The `binder` directory has requirements for that notebook, per the Binder documentation.
24
-
25
16
## Related MITRE Work
26
17
#### CTI
27
18
[Cyber Threat Intelligence repository](https://github.com/mitre/cti) of the ATT&CK catalog expressed in STIX 2.0 JSON.
Copy file name to clipboardExpand all lines: layers/README.md
+46-2Lines changed: 46 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ This folder contains modules and scripts for working with ATT&CK Navigator layer
7
7
|:-------|:------------|
8
8
|[filter](core/filter.py)| Implements a basic [filter object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv3.md#filter-object-properties). |
9
9
|[gradient](core/gradient.py)| Implements a basic [gradient object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv3.md#gradient-object-properties). |
10
-
|[layer](core/layer.py)| Provides an interface for interacting with core module's layer representation. A further breakdown can be found in the corresponding section below. |
10
+
|[layer](core/layer.py)| Provides an interface for interacting with core module's layer representation. A further breakdown can be found in the corresponding [section](#Layer) below. |
11
11
|[layout](core/layout.py)| Implements a basic [layout object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv3.md#layout-object-properties). |
12
12
|[legenditem](core/legenditem.py)| Implements a basic [legenditem object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv3.md#legenditem-object-properties). |
13
13
|[metadata](core/metadata.py)| Implements a basic [metadata object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv3.md#metadata-object-properties). |
@@ -16,7 +16,17 @@ This folder contains modules and scripts for working with ATT&CK Navigator layer
16
16
#### Manipulator Scripts
17
17
| script | description |
18
18
|:-------|:------------|
19
-
|[layerops](manipulators/layerops.py)| Provides a means by which to combine multiple ATT&CK layer objects in customized ways. A further breakdown can be found in the corresponding section below. |
19
+
|[layerops](manipulators/layerops.py)| Provides a means by which to combine multiple ATT&CK layer objects in customized ways. A further breakdown can be found in the corresponding [section](#layerops.py) below. |
20
+
21
+
#### Exporter Scripts
22
+
| script | description |
23
+
|:-------|:------------|
24
+
|[to_excel](exporters/to_excel.py)| Provides a means by which to export an ATT&CK Layer to an excel file. A further breakdown can be found in the corresponding [section](#to_excel.py) below. |
25
+
##### Utility Modules
26
+
| script | description |
27
+
|:-------|:------------|
28
+
|[excel_templates](exporters/excel_templates.py)| Provides a means by which to convert a matrix into a clean excel matrix template. |
29
+
|[matrix_gen](exporters/matrix_gen.py)| Provides a means by which to generate a matrix from raw data, either from the ATT&CK TAXII server or from a local STIX Bundle. |
20
30
21
31
## Layer
22
32
The Layer class provides format validation and read/write capabilities to aid in working with ATT&CK Navigator Layers in python. It is the primary interface through which other Layer-related classes defined in the core module should be used. The Layer class API and a usage example are below.
out_layer6 = lo4.process([demo2, demo3]) # Trigger processing on a list of demo2 and demo0
120
130
out_layer6.to_file("C:\demo_layer6.json") # Save combined comment layer to file
121
131
```
132
+
133
+
## to_excel.py
134
+
to_excel.py provides the ToExcel class, which is a way to export an existing layer file as an Excel
135
+
spreadsheet. The ToExcel class has an optional parameter for the initialization function, that
136
+
tells the exporter what data source to use when building the output matrix. Valid options include using live data from cti-taxii.mitre.org or using a local STIX bundle.
137
+
138
+
##### ToExcel()
139
+
```python
140
+
x = ToExcel(domain='enterprise', source='taxii', local=None)
141
+
```
142
+
The ToExcel constructor takes domain, server, and local arguments during instantiation. The domain can
143
+
be either `enterprise` or `mobile`, and can be pulled directly from a layer file as `layer.domain`. The source argument tells the matrix generation tool which data source to use when building the matrix. `taxii` indicates that the tool should utilize the `cti-taxii` server when building the matrix, while the `local` option indicates that it should use a local bundle respectively. The local argument is only required if the source is set to `local`, in which case it should be a path to a local stix bundle.
144
+
145
+
##### .to_file() Method
146
+
```python
147
+
x.to_xlsx(layer=layer, filepath="layer.xlsx")
148
+
```
149
+
The to_xlsx method exports the layer file referenced as `layer`, as an excel file to the
150
+
`filepath` specified.
151
+
152
+
#### Example Usage
153
+
```python
154
+
from layers import Layer
155
+
from layers import ToExcel
156
+
157
+
lay = Layer()
158
+
lay.from_file("path/to/layer/file.json")
159
+
# Using taxii server for template
160
+
t = ToExcel(domain=lay.layer.domain, source='taxii')
0 commit comments