Skip to content
This repository was archived by the owner on Dec 11, 2023. It is now read-only.

Commit 41991c6

Browse files
committed
ATT&CK v1.5.1
2 parents 6ddedd3 + a4d5c73 commit 41991c6

File tree

17 files changed

+876
-488
lines changed

17 files changed

+876
-488
lines changed

.gitignore

Lines changed: 166 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,166 @@
1-
.DS_Store
1+
# Created by https://www.toptal.com/developers/gitignore/api/python,macos
2+
# Edit at https://www.toptal.com/developers/gitignore?templates=python,macos
3+
4+
### macOS ###
5+
# General
6+
.DS_Store
7+
.AppleDouble
8+
.LSOverride
9+
10+
# Icon must end with two \r
11+
Icon
12+
13+
# Thumbnails
14+
._*
15+
16+
# Files that might appear in the root of a volume
17+
.DocumentRevisions-V100
18+
.fseventsd
19+
.Spotlight-V100
20+
.TemporaryItems
21+
.Trashes
22+
.VolumeIcon.icns
23+
.com.apple.timemachine.donotpresent
24+
25+
# Directories potentially created on remote AFP share
26+
.AppleDB
27+
.AppleDesktop
28+
Network Trash Folder
29+
Temporary Items
30+
.apdisk
31+
32+
### Python ###
33+
# Byte-compiled / optimized / DLL files
34+
__pycache__/
35+
*.py[cod]
36+
*$py.class
37+
38+
# C extensions
39+
*.so
40+
41+
# Distribution / packaging
42+
.Python
43+
build/
44+
develop-eggs/
45+
dist/
46+
downloads/
47+
eggs/
48+
.eggs/
49+
lib/
50+
lib64/
51+
parts/
52+
sdist/
53+
var/
54+
wheels/
55+
pip-wheel-metadata/
56+
share/python-wheels/
57+
*.egg-info/
58+
.installed.cfg
59+
*.egg
60+
MANIFEST
61+
62+
# PyInstaller
63+
# Usually these files are written by a python script from a template
64+
# before PyInstaller builds the exe, so as to inject date/other infos into it.
65+
*.manifest
66+
*.spec
67+
68+
# Installer logs
69+
pip-log.txt
70+
pip-delete-this-directory.txt
71+
72+
# Unit test / coverage reports
73+
htmlcov/
74+
.tox/
75+
.nox/
76+
.coverage
77+
.coverage.*
78+
.cache
79+
nosetests.xml
80+
coverage.xml
81+
*.cover
82+
*.py,cover
83+
.hypothesis/
84+
.pytest_cache/
85+
86+
# Translations
87+
*.mo
88+
*.pot
89+
90+
# Django stuff:
91+
*.log
92+
local_settings.py
93+
db.sqlite3
94+
db.sqlite3-journal
95+
96+
# Flask stuff:
97+
instance/
98+
.webassets-cache
99+
100+
# Scrapy stuff:
101+
.scrapy
102+
103+
# Sphinx documentation
104+
docs/_build/
105+
106+
# PyBuilder
107+
target/
108+
109+
# Jupyter Notebook
110+
.ipynb_checkpoints
111+
112+
# IPython
113+
profile_default/
114+
ipython_config.py
115+
116+
# pyenv
117+
.python-version
118+
119+
# pipenv
120+
# According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
121+
# However, in case of collaboration, if having platform-specific dependencies or dependencies
122+
# having no cross-platform support, pipenv may install dependencies that don't work, or not
123+
# install all needed dependencies.
124+
#Pipfile.lock
125+
126+
# PEP 582; used by e.g. github.com/David-OConnor/pyflow
127+
__pypackages__/
128+
129+
# Celery stuff
130+
celerybeat-schedule
131+
celerybeat.pid
132+
133+
# SageMath parsed files
134+
*.sage.py
135+
136+
# Environments
137+
.env
138+
.venv
139+
env/
140+
venv/
141+
ENV/
142+
env.bak/
143+
venv.bak/
144+
145+
# Spyder project settings
146+
.spyderproject
147+
.spyproject
148+
149+
# Rope project settings
150+
.ropeproject
151+
152+
# mkdocs documentation
153+
/site
154+
155+
# mypy
156+
.mypy_cache/
157+
.dmypy.json
158+
dmypy.json
159+
160+
# Pyre type checker
161+
.pyre/
162+
163+
# pytype static type analyzer
164+
.pytype/
165+
166+
# End of https://www.toptal.com/developers/gitignore/api/python,macos

CHANGELOG.md

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
# v1.5.1 - 27 July 2020
2+
## New Scripts
3+
- Added [layer to excel](https://github.com/mitre-attack/attack-scripts/tree/master/layers#to_excelpy) converter. See issue [#25](https://github.com/mitre-attack/attack-scripts/issues/25).
4+
## Improvements
5+
- Updated README to better describe repo contents.
6+
- Removed outdated detection training. See issue [#37](https://github.com/mitre-attack/attack-scripts/issues/37).
7+
18
# v1.5 - 8 July 2020
29
## New Scripts
310
Added scripts used to generate the [sample layers in the ATT&CK Navigator repository](https://github.com/mitre-attack/attack-navigator/tree/develop/layers/data/samples). See issue [#21](https://github.com/mitre-attack/attack-scripts/issues/21) and [the sample layer README](scripts/layers/samples/README.md) for more details. The following scripts were added:
@@ -16,7 +23,7 @@ Added scripts used to generate the [sample layers in the ATT&CK Navigator reposi
1623
## Fixes
1724
- Fixed bug in LayerOps causing issues with cross-tactic techniques, as well as a bug where a score lambda could affect the outcome of other lambdas.
1825

19-
# v1.4 - 5 May 2020
26+
# V1.4 - 5 May 2020
2027
## New Scripts
2128
- Added Layers folder with utility scripts for working with [ATT&CK Navigator](https://github.com/mitre-attack/attack-navigator) Layers. See the Layers [README](layers/README.md) for more details. See issues [#2](https://github.com/mitre-attack/attack-scripts/issues/2) and [#3](https://github.com/mitre-attack/attack-scripts/issues/3).
2229

README.md

Lines changed: 4 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
# attack-scripts
22

3-
This repository is intended to provide a library of functions to improve users' interactions with ATT&CK content. In addition, it will provide one-off scripts
4-
for processing and visualizing ATT&CK content — See [the scripts folder](scripts) for more details.
5-
6-
Note: this repository is a work in progress. In the coming months we will be adding additional functionalities as well as soliciting scripts from ATT&CK users — see [contributing to attack-scripts](CONTRIBUTING.md).
3+
This repository contains various tools and utilities for working with ATT&CK content.
4+
- the [scripts](scripts) folder contains one-off scripts for processing and visualizing ATT&CK content.
5+
- the [scripts/layers/samples](scripts/layers/samples) folder contains one-off scripts demonstrating the generation of ATT&CK Navigator layers from ATT&CK data. The outputs of these scripts can also be found on the [ATT&CK Navigator repository](https://github.com/mitre-attack/attack-navigator/tree/master/layers/data/samples).
6+
- the [layers](layers) folder contains a collection of modules and scripts for working with [ATT&CK Navigator](https://github.com/mitre-attack/attack-navigator) layers.
77

88
## Requirements
99
- [python3](https://www.python.org/)
@@ -13,15 +13,6 @@ Note: this repository is a work in progress. In the coming months we will be add
1313
2. Activate the environment: `source env/bin/activate`
1414
3. Install requirements into the virtual environment: `pip3 install -r requirements.txt`
1515

16-
## Layers
17-
This section of the repository contains a collection of modules and scripts for working with ATT&CK Navigator layers. More information about the contents of this section can be found [here](https://github.com/mitre-attack/attack-scripts/blob/master/layers/README.md).
18-
19-
## Training
20-
21-
[![Binder](https://mybinder.org/badge_logo.svg)](https://mybinder.org/v2/gh/mitre-attack/attack-scripts/master)
22-
23-
This repository also contains Jupyter notebooks and other material for ATT&CK training. The `trainings` directory has that content, which can be launched via Binder. The `binder` directory has requirements for that notebook, per the Binder documentation.
24-
2516
## Related MITRE Work
2617
#### CTI
2718
[Cyber Threat Intelligence repository](https://github.com/mitre/cti) of the ATT&CK catalog expressed in STIX 2.0 JSON.

binder/requirements.txt

Lines changed: 0 additions & 56 deletions
This file was deleted.

layers/README.md

Lines changed: 46 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ This folder contains modules and scripts for working with ATT&CK Navigator layer
77
|:-------|:------------|
88
| [filter](core/filter.py) | Implements a basic [filter object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv3.md#filter-object-properties). |
99
| [gradient](core/gradient.py) | Implements a basic [gradient object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv3.md#gradient-object-properties). |
10-
| [layer](core/layer.py) | Provides an interface for interacting with core module's layer representation. A further breakdown can be found in the corresponding section below. |
10+
| [layer](core/layer.py) | Provides an interface for interacting with core module's layer representation. A further breakdown can be found in the corresponding [section](#Layer) below. |
1111
| [layout](core/layout.py) | Implements a basic [layout object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv3.md#layout-object-properties). |
1212
| [legenditem](core/legenditem.py) | Implements a basic [legenditem object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv3.md#legenditem-object-properties). |
1313
| [metadata](core/metadata.py) | Implements a basic [metadata object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv3.md#metadata-object-properties). |
@@ -16,7 +16,17 @@ This folder contains modules and scripts for working with ATT&CK Navigator layer
1616
#### Manipulator Scripts
1717
| script | description |
1818
|:-------|:------------|
19-
| [layerops](manipulators/layerops.py) | Provides a means by which to combine multiple ATT&CK layer objects in customized ways. A further breakdown can be found in the corresponding section below. |
19+
| [layerops](manipulators/layerops.py) | Provides a means by which to combine multiple ATT&CK layer objects in customized ways. A further breakdown can be found in the corresponding [section](#layerops.py) below. |
20+
21+
#### Exporter Scripts
22+
| script | description |
23+
|:-------|:------------|
24+
| [to_excel](exporters/to_excel.py) | Provides a means by which to export an ATT&CK Layer to an excel file. A further breakdown can be found in the corresponding [section](#to_excel.py) below. |
25+
##### Utility Modules
26+
| script | description |
27+
|:-------|:------------|
28+
| [excel_templates](exporters/excel_templates.py) | Provides a means by which to convert a matrix into a clean excel matrix template. |
29+
| [matrix_gen](exporters/matrix_gen.py) | Provides a means by which to generate a matrix from raw data, either from the ATT&CK TAXII server or from a local STIX Bundle. |
2030

2131
## Layer
2232
The Layer class provides format validation and read/write capabilities to aid in working with ATT&CK Navigator Layers in python. It is the primary interface through which other Layer-related classes defined in the core module should be used. The Layer class API and a usage example are below.
@@ -119,3 +129,37 @@ lo4 = LayerOps(score=lambda x: '; '.join(x),
119129
out_layer6 = lo4.process([demo2, demo3]) # Trigger processing on a list of demo2 and demo0
120130
out_layer6.to_file("C:\demo_layer6.json") # Save combined comment layer to file
121131
```
132+
133+
## to_excel.py
134+
to_excel.py provides the ToExcel class, which is a way to export an existing layer file as an Excel
135+
spreadsheet. The ToExcel class has an optional parameter for the initialization function, that
136+
tells the exporter what data source to use when building the output matrix. Valid options include using live data from cti-taxii.mitre.org or using a local STIX bundle.
137+
138+
##### ToExcel()
139+
```python
140+
x = ToExcel(domain='enterprise', source='taxii', local=None)
141+
```
142+
The ToExcel constructor takes domain, server, and local arguments during instantiation. The domain can
143+
be either `enterprise` or `mobile`, and can be pulled directly from a layer file as `layer.domain`. The source argument tells the matrix generation tool which data source to use when building the matrix. `taxii` indicates that the tool should utilize the `cti-taxii` server when building the matrix, while the `local` option indicates that it should use a local bundle respectively. The local argument is only required if the source is set to `local`, in which case it should be a path to a local stix bundle.
144+
145+
##### .to_file() Method
146+
```python
147+
x.to_xlsx(layer=layer, filepath="layer.xlsx")
148+
```
149+
The to_xlsx method exports the layer file referenced as `layer`, as an excel file to the
150+
`filepath` specified.
151+
152+
#### Example Usage
153+
```python
154+
from layers import Layer
155+
from layers import ToExcel
156+
157+
lay = Layer()
158+
lay.from_file("path/to/layer/file.json")
159+
# Using taxii server for template
160+
t = ToExcel(domain=lay.layer.domain, source='taxii')
161+
t.to_xlsx(layer=lay, filepath="demo.xlsx")
162+
#Using local stix data for template
163+
t2 = ToExcel(domain='mobile', source='local', local='path/to/local/stix.json')
164+
t2.to_xlsx(layer=lay, filepath="demo2.xlsx")
165+
```

layers/__init__.py

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
from .core import *
2+
from .exporters import *
3+
from .manipulators import *

0 commit comments

Comments
 (0)