feat: add detection strategy table on technique page

Author: adpare

attack-theme/templates/macros/detection_strategies_table.html

@@ -0,0 +1,40 @@
+{% import 'macros/clean_output.html' as clean_output %}
+
+{% macro detection_strategies_table(detection_strategies) %}
+<div class="tables-mobile">
+<table class="table datasources-table table-bordered">
+    <thead>
+        <tr>
+            <th class="p-2" scope="col">ID</th>
+            <th class="p-2 nowrap" scope="col">Name</th>
+            <th class="p-2 nowrap" scope="col">Analytics</th>
+        </tr>
+    </thead>
+    <tbody>
+        {% for detection_strategy in detection_strategies %}
+            <tr class="detection_strategy" id="uses-{{detection_strategy.id}}">
+                <td>
+                    <a href="/detectionstrategies/{{detection_strategy.id}}">{{detection_strategy.id}}</a>
+                </td>
+                <td class="nowrap">
+                    <a href="/detectionstrategies/{{detection_strategy.id}}">{{detection_strategy.name}}</a>
+                </td>
+                <td>
+                    {% if detection_strategy.analytics %}
+                        <ul class="list-unstyled mb-0">
+                            {% for analytic in detection_strategy.analytics %}
+                                <li>
+                                    <a href="/analytics/{{analytic.id}}">{{ analytic.id }}</a>
+                                </li>
+                            {% endfor %}
+                        </ul>
+                    {% else %}
+                        <span class="text-muted">None</span>
+                    {% endif %}
+                </td>
+            </tr>
+        {% endfor %}
+    </tbody>
+</table>
+</div>
+{% endmacro %}

modules/analytics/analytics.py

@@ -90,7 +90,7 @@ def generate_analytic_md(analytic, sidebar_data, notes):
     """Generate markdown for individual analytic pages."""
     attack_id = util.buildhelpers.get_attack_id(analytic)
     if not attack_id:
-        logger.debug(f"No attack ID found on analytic: {analytic["id"]}")
+        logger.debug(f"No attack ID found on analytic: {analytic['id']}")
         return
 
     # build reference list
@@ -149,7 +149,7 @@ def build_log_source_table(analytic):
 
     log_sources = analytic.get("x_mitre_log_source_references")
     if not log_sources:
-        logger.debug(f"No log source references found on Analytic {analytic["id"]}")
+        logger.debug(f"No log source references found on Analytic {analytic['id']}")
         return log_source_table
 
     for log_source in log_sources:

modules/techniques/techniques.py

@@ -218,6 +218,9 @@ def generate_data_for_md(technique_dict, technique, tactic_list, is_sub_techniqu
             # Get asset table
             technique_dict["assets_table"] = get_assets_table_data(technique, reference_list)
 
+            # Get detection strategy table
+            technique_dict["detections_strategies_table"] = get_detection_strategies_table_data(technique, reference_list)
+
             # Get technique version
             if technique.get("x_mitre_version"):
                 technique_dict["version"] = technique["x_mitre_version"]
@@ -410,6 +413,43 @@ def get_assets_table_data(technique, reference_list):
         asset_data = sorted(asset_data, key=lambda k: k["name"].lower())
     return asset_data
 
+def get_analytic_list(analytics):
+    analytics_list = []
+    for keys, values in analytics.items():
+        analytics_list.append({'id': values["external_references"][0]["external_id"]})
+    return analytics_list
+
+def get_detection_strategies_table_data(technique, reference_list):
+    """Return detection strategy data for a technique.
+
+    Given a technique and a reference list, find detection strategies targeted by the
+    technique and return a list with detection strategy data. Also modify the reference
+    list if a relationship reference is not present in the list.
+    """
+    detection_strategy_data = []
+
+    # Check if technique has assets
+    detection_strategies_for_techniques = util.relationshipgetters.get_detectionstrategies_detecting_technique().get(technique["id"])
+    if detection_strategies_for_techniques:
+        # Iterate through technique assets
+        for detection_strategy in detection_strategies_for_techniques:
+            # Do not add deprecated assets to table
+            if not detection_strategy["object"].get("x_mitre_deprecated"):
+                attack_id = util.buildhelpers.get_attack_id(detection_strategy["object"])
+
+                # Only add if attack id is found
+                if not attack_id:
+                    continue
+                row = {}
+                row["id"] = attack_id
+                row["name"] = detection_strategy["object"]["name"]
+                row["analytics"] = get_analytic_list(util.stixhelpers.get_analytics_from_detection_strategy(detection_strategy["object"]))
+                detection_strategy_data.append(row)
+
+    if detection_strategy_data:
+        detection_strategy_data = sorted(detection_strategy_data, key=lambda k: k["name"].lower())
+    return detection_strategy_data
+
 
 def get_examples_table_data(technique, reference_list):
     """Return example data for a technique.

modules/techniques/templates/technique.html

@@ -4,7 +4,8 @@
 {% import 'macros/deprecated.html' as deprecated %}
 {% import 'macros/clean_output.html' as clean_output %}
 {% import 'macros/citations.html' as citations %}
-{% import 'macros/datasource_table.html' as datasource_table %}
+<!-- {% import 'macros/datasource_table.html' as datasource_table %} -->
+{% import 'macros/detection_strategies_table.html' as detection_strategies_table %}
 
 {% import 'macros/notes.html' as notes %}
 {% if parsed.parent_name %}
@@ -431,11 +432,15 @@ <h2 class="pt-3" id ="mitigations">Mitigations</h2>
                             {% endif %}
                         {% endif %}
                         {% if parsed.detection or parsed.datasources %}
-                            <h2 class="pt-3" id="detection">Detection</h2>
-                            {% if parsed.datasources %}
-                                {{datasource_table.datasource_table(parsed.datasources, parsed.show_descriptions, parsed.citations)}}
+                            {% if parsed.detections_strategies_table %}
+                                <h2 class="pt-3" id="detection">Detection Strategies</h2>
+                                {{detection_strategies_table.detection_strategies_table(parsed.detections_strategies_table)}}
                             {% endif %}
+                            <!-- {% if parsed.datasources %}
+                                {{datasource_table.datasource_table(parsed.datasources, parsed.show_descriptions, parsed.citations)}}
+                            {% endif %} -->
                             {% if parsed.detection and not parsed.show_descriptions %}
+                                <h2 class="pt-3" id="detection">Detection</h2>
                                 <div>
                                     {{clean_output.stixToHTML(parsed.detection, parsed.citations)}}
                                 </div>