valitydev/atomic-threat-coverage
14
0
Fork 0
mirror of https://github.com/valitydev/atomic-threat-coverage.git synced 2024-11-06 09:35:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #161 from VVX7/amitt

Browse Source 
chg: [template] conditionally list IR phases in RP body
This commit is contained in:
Roger Johnston 2020-02-18 19:10:21 -05:00 committed by GitHub
commit cf37134c6c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 25 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Makefile
View File

@ -1,6 +1,6 @@
.PHONY: all analytics navigator elastic setup clean visualizations thehive
all: setup_repo markdown confluence analytics navigator elastic
all: markdown confluence analytics navigator elastic
analytics: create_analytics_and_pivoting_csv
navigator: create_attack_navigator_profile create_attack_navigator_profile_per_customer
elastic: create_es_export

24
scripts/responseplaybook.py
View File

@ -193,11 +193,21 @@ class ResponsePlaybook:
eradication = []
recovery = []
lessons_learned = []
detect = []
deny = []
disrupt = []
degrade = []
deceive = []
destroy = []
deter = []
stages = [
('identification', identification),
('containment', containment), ('eradication', eradication),
('recovery', recovery), ('lessons_learned', lessons_learned)
('recovery', recovery), ('lessons_learned', lessons_learned),
('detect', detect), ('deny', deny), ('disrupt', disrupt),
('degrade', degrade), ('deceive', deceive), ('destroy', destroy),
('deter', deter)
]
for stage_name, stage_list in stages:
@ -235,11 +245,21 @@ class ResponsePlaybook:
eradication = []
recovery = []
lessons_learned = []
detect = []
deny = []
disrupt = []
degrade = []
deceive = []
destroy = []
deter = []
stages = [
('identification', identification),
('containment', containment), ('eradication', eradication),
('recovery', recovery), ('lessons_learned', lessons_learned)
('recovery', recovery), ('lessons_learned', lessons_learned),
('detect', detect), ('deny', deny), ('disrupt', disrupt),
('degrade', degrade), ('deceive', deceive), ('destroy', destroy),
('deter', deter)
]
# grab workflow per action in each IR stages

3
scripts/templates/markdown_responseplaybook_template.md.j2
View File

@ -13,8 +13,7 @@
{{ workflow }}
{% for stage_name, stage_actions in stages %}
#### {{ stage_name }}
{% if stage_actions is not none and stage_actions|length %}#### {{ stage_name }}{% endif %}
{% for action_description, action_workflow in stage_actions%}
##### {{ action_description }}

2
scripts/update_amitt_mapping.py
View File

@ -6,7 +6,7 @@ amitt_tactic_mapping = {}
amitt_technique_mapping = {}
amitt_mitigation_mapping = {}
#amitt_json_url = ("https://raw.githubusercontent.com/VVX7/cti/master/amitt-attack/amitt-attack.json")
amitt_json_url = ("https://raw.githubusercontent.com/cogsec-collaborative/amitt_cti/master/amitt/amitt-attack.json")
amitt_json = requests.get(amitt_json_url).json()