Skip to content

Commit 329ef94

Browse files
authored
Merge branch 'master' into update-replay-guide
2 parents 7d49a1c + 3b92935 commit 329ef94

File tree

13 files changed

+419
-396
lines changed

13 files changed

+419
-396
lines changed

.gitattributes

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
*.json filter=lfs diff=lfs merge=lfs -text
21
*.log filter=lfs diff=lfs merge=lfs -text
32
*.log text encoding=utf-8
3+
datasets/**/*.json filter=lfs diff=lfs merge=lfs -text

.github/workflows/validate.yml

Lines changed: 91 additions & 93 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ name: Validate Attack Data
22

33
on:
44
pull_request:
5-
branches: [ master, main ]
5+
branches: [master, main]
66
types: [opened, synchronize, reopened]
77
paths:
88
- 'datasets/**/*.yml'
@@ -11,7 +11,7 @@ on:
1111
- 'bin/dataset_schema.json'
1212
- 'bin/requirements.txt'
1313
push:
14-
branches: [ master, main ]
14+
branches: [master, main]
1515
paths:
1616
- 'datasets/**/*.yml'
1717
- 'datasets/**/*.yaml'
@@ -27,97 +27,95 @@ permissions:
2727
jobs:
2828
validate-attack-data:
2929
runs-on: ubuntu-latest
30-
30+
3131
steps:
32-
- name: Checkout repository
33-
uses: actions/checkout@v4
34-
with:
35-
lfs: true
36-
37-
- name: Set up Python
38-
uses: actions/setup-python@v4
39-
with:
40-
python-version: '3.9'
41-
cache: 'pip'
42-
43-
- name: Install dependencies
44-
run: |
45-
python -m pip install --upgrade pip
46-
pip install -r bin/requirements.txt
47-
48-
# Validate all YAML files
49-
- name: Validate all YAML files
50-
run: |
51-
python bin/validate.py
52-
env:
53-
PYTHONPATH: ${{ github.workspace }}/bin
54-
55-
# PR-specific success/failure handling
56-
- name: Comment PR on validation failure
57-
if: failure() && github.event_name == 'pull_request'
58-
uses: actions/github-script@v7
59-
with:
60-
script: |
61-
const { owner, repo, number } = context.issue;
62-
63-
const body = `❌ **Attack Data Validation Failed**
64-
65-
The YAML files in this PR do not pass validation. Please check the workflow logs for detailed error messages and fix the issues before merging.
66-
67-
[View workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})`;
68-
69-
await github.rest.issues.createComment({
70-
owner,
71-
repo,
72-
issue_number: number,
73-
body: body
74-
});
75-
76-
- name: Comment PR on validation success
77-
if: success() && github.event_name == 'pull_request'
78-
uses: actions/github-script@v7
79-
with:
80-
script: |
81-
const { owner, repo, number } = context.issue;
82-
83-
const body = `✅ **Attack Data Validation Passed**
84-
85-
All YAML files in this PR have been successfully validated against the schema.
86-
87-
Ready for review and merge! 🚀`;
88-
89-
await github.rest.issues.createComment({
90-
owner,
91-
repo,
92-
issue_number: number,
93-
body: body
94-
});
95-
96-
# Push-specific failure handling (create issue)
97-
- name: Create issue on validation failure (Push)
98-
if: failure() && github.event_name == 'push'
99-
uses: actions/github-script@v7
100-
with:
101-
script: |
102-
const title = `🚨 Attack Data Validation Failed - ${new Date().toISOString().split('T')[0]}`;
103-
const body = `**Validation failed on push to ${context.ref}**
104-
105-
Commit: ${context.sha}
106-
107-
The YAML files in the datasets directory do not pass validation. This indicates that invalid data has been merged into the main branch.
108-
109-
**Action Required:**
110-
1. Review the [failed workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
111-
2. Fix the validation errors
112-
3. Create a hotfix PR to resolve the issues
113-
`;
114-
115-
await github.rest.issues.create({
116-
owner: context.repo.owner,
117-
repo: context.repo.repo,
118-
title: title,
119-
body: body,
120-
labels: ['bug', 'validation-failure', 'high-priority']
121-
});
32+
- name: Checkout repository
33+
uses: actions/checkout@v4
34+
with:
35+
lfs: 'false'
36+
37+
- name: Set up Python
38+
uses: actions/setup-python@v4
39+
with:
40+
python-version: '3.9'
41+
cache: 'pip'
42+
43+
- name: Install dependencies
44+
run: |
45+
python -m pip install --upgrade pip
46+
pip install -r bin/requirements.txt
47+
48+
# Validate all YAML files
49+
- name: Validate all YAML files
50+
run: |
51+
python bin/validate.py
52+
env:
53+
PYTHONPATH: ${{ github.workspace }}/bin
54+
55+
# PR-specific success/failure handling
56+
- name: Comment PR on validation failure
57+
if: failure() && github.event_name == 'pull_request'
58+
uses: actions/github-script@v7
59+
with:
60+
script: |
61+
const { owner, repo, number } = context.issue;
62+
63+
const body = `❌ **Attack Data Validation Failed**
64+
65+
The YAML files in this PR do not pass validation. Please check the workflow logs for detailed error messages and fix the issues before merging.
66+
67+
[View workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})`;
68+
69+
await github.rest.issues.createComment({
70+
owner,
71+
repo,
72+
issue_number: number,
73+
body: body
74+
});
75+
76+
- name: Comment PR on validation success
77+
if: success() && github.event_name == 'pull_request'
78+
uses: actions/github-script@v7
79+
with:
80+
script: |
81+
const { owner, repo, number } = context.issue;
82+
83+
const body = `✅ **Attack Data Validation Passed**
84+
85+
All YAML files in this PR have been successfully validated against the schema.
86+
87+
Ready for review and merge! 🚀`;
88+
89+
await github.rest.issues.createComment({
90+
owner,
91+
repo,
92+
issue_number: number,
93+
body: body
94+
});
95+
96+
# Push-specific failure handling (create issue)
97+
- name: Create issue on validation failure (Push)
98+
if: failure() && github.event_name == 'push'
99+
uses: actions/github-script@v7
100+
with:
101+
script: |
102+
const title = `🚨 Attack Data Validation Failed - ${new Date().toISOString().split('T')[0]}`;
103+
const body = `**Validation failed on push to ${context.ref}**
104+
105+
Commit: ${context.sha}
106+
107+
The YAML files in the datasets directory do not pass validation. This indicates that invalid data has been merged into the main branch.
122108
109+
**Action Required:**
110+
1. Review the [failed workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
111+
2. Fix the validation errors
112+
3. Create a hotfix PR to resolve the issues
113+
`;
123114
115+
await github.rest.issues.create({
116+
owner: context.repo.owner,
117+
repo: context.repo.repo,
118+
title: title,
119+
body: body,
120+
labels: ['bug', 'validation-failure', 'high-priority']
121+
});

bin/dataset_schema.json

Lines changed: 91 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,91 @@
1-
version https://git-lfs.github.com/spec/v1
2-
oid sha256:97085370d23378475c243e900bfeb0b462b849ff3e2b4f38fec5547177c91a3b
3-
size 2274
1+
{
2+
"$schema": "http://json-schema.org/draft-07/schema#",
3+
"title": "Attack Data Dataset Schema",
4+
"description": "JSON Schema for validating YAML dataset files in the attack_data project",
5+
"type": "object",
6+
"required": [
7+
"author",
8+
"id",
9+
"date",
10+
"description",
11+
"environment",
12+
"datasets"
13+
],
14+
"properties": {
15+
"author": {
16+
"type": "string",
17+
"minLength": 1,
18+
"description": "Author(s) of the dataset"
19+
},
20+
"id": {
21+
"type": "string",
22+
"format": "uuid",
23+
"description": "UUID identifier for the dataset"
24+
},
25+
"date": {
26+
"type": "string",
27+
"description": "Date of the dataset"
28+
},
29+
"description": {
30+
"type": "string",
31+
"minLength": 1,
32+
"description": "Description of the dataset"
33+
},
34+
"environment": {
35+
"type": "string",
36+
"minLength": 1,
37+
"description": "Environment where the dataset was created"
38+
},
39+
"directory": {
40+
"type": "string",
41+
"minLength": 1,
42+
"description": "Directory name for the dataset"
43+
},
44+
"mitre_technique": {
45+
"type": "array",
46+
"items": {
47+
"type": "string",
48+
"pattern": "^T\\d{4}(\\.\\d{3})*$"
49+
},
50+
"description": "List of MITRE ATT&CK technique IDs (can be empty)"
51+
},
52+
"datasets": {
53+
"type": "array",
54+
"minItems": 1,
55+
"items": {
56+
"type": "object",
57+
"required": [
58+
"name",
59+
"path",
60+
"source",
61+
"sourcetype"
62+
],
63+
"properties": {
64+
"name": {
65+
"type": "string",
66+
"minLength": 1,
67+
"description": "Name of the dataset"
68+
},
69+
"path": {
70+
"type": "string",
71+
"minLength": 1,
72+
"description": "Path to the dataset file"
73+
},
74+
"source": {
75+
"type": "string",
76+
"minLength": 1,
77+
"description": "Source of the data"
78+
},
79+
"sourcetype": {
80+
"type": "string",
81+
"minLength": 1,
82+
"description": "Type of the data source"
83+
}
84+
},
85+
"additionalProperties": false
86+
},
87+
"description": "List of datasets (must contain at least one dataset)"
88+
}
89+
},
90+
"additionalProperties": false
91+
}
Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
version https://git-lfs.github.com/spec/v1
2+
oid sha256:6556ab4d3665ac2ffa87f5db2347b95de9e118e610a0d873b9f530a0b36b41b9
3+
size 4542
Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
author: Teoderick Contreras, Splunk
2+
id: d6e44c10-a410-11f0-8c8b-629be353806a
3+
date: '2025-10-08'
4+
description: Generated datasets for reg profiles private2 in attack range.
5+
environment: attack_range
6+
directory: reg_profiles_private
7+
mitre_technique:
8+
- T1112
9+
datasets:
10+
- name: reg_profiles_private2.log
11+
path: /datasets/attack_techniques/T1112/reg_profiles_private2/reg_profiles_private2.log
12+
sourcetype: 'XmlWinEventLog'
13+
source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
version https://git-lfs.github.com/spec/v1
2+
oid sha256:055f282a2c4f1396db511c10ed4016241072fcbfb78e8de64f6614601c554109
3+
size 1949
Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
author: Nasreddine Bencherchali, Splunk
2+
id: 169da367-87f4-413d-b0c9-b8c13e01d489
3+
date: '2025-10-07'
4+
description: Generated datasets for fsutil SymlinkEvaluation set in attack range.
5+
environment: attack_range
6+
directory: fsutil_symlink_eval
7+
mitre_technique:
8+
- T1222.001
9+
datasets:
10+
- name: fsutil_symlink_eval.log
11+
path: /datasets/attack_techniques/T1222.001/fsutil_symlink_eval/fsutil_symlink_eval.log
12+
sourcetype: XmlWinEventLog
13+
source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
version https://git-lfs.github.com/spec/v1
2+
oid sha256:b27a22a9bcae4e4fdb597ebb7a5b9dcbfe80609608ec76ee833d3f303a684bd5
3+
size 195551

0 commit comments

Comments
 (0)