MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-26 16:57:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: [att&ck converter] allow multiple external IDs

Browse source 
- There are in some cases external ID references to CAPEC in addition to ATT&CK in techniques
- convert external ID to a list rather than a single string

- as reported by @SYNchroACK
- as hurried along by a disappointed @deresz
This commit is contained in:
Andras Iklody 2022-11-28 12:25:25 +01:00 committed by GitHub
parent fda4160bed
commit 13dbf70d77
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
tools/mitre-cti/v2.0/create_mitre-enterprise-attack-attack-pattern_galaxy.py
View file

@ -25,11 +25,12 @@ for element in os.listdir('.'):
value['value'] = temp['name'] + ' - ' + temp['external_references'][0]['external_id'] value['value'] = temp['name'] + ' - ' + temp['external_references'][0]['external_id']
value['meta'] = {} value['meta'] = {}
value['meta']['refs'] = [] value['meta']['refs'] = []
value['meta']['external_id'] = []
for reference in temp['external_references']: for reference in temp['external_references']:
if 'url' in reference and reference['url'] not in value['meta']['refs']: if 'url' in reference and reference['url'] not in value['meta']['refs']:
value['meta']['refs'].append(reference['url']) value['meta']['refs'].append(reference['url'])
if 'external_id' in reference: if 'external_id' in reference and reference['external_id'] not in value['meta']['external_id]:
value['meta']['external_id'] = reference['external_id'] value['meta']['external_id'].append(reference['external_id'])
value['meta']['kill_chain'] = [] value['meta']['kill_chain'] = []
for killchain in temp['kill_chain_phases']: for killchain in temp['kill_chain_phases']:
value['meta']['kill_chain'].append(killchain['kill_chain_name'] + ':enterprise-attack:' + killchain['phase_name']) value['meta']['kill_chain'].append(killchain['kill_chain_name'] + ':enterprise-attack:' + killchain['phase_name'])