Skip to content

Feature/#304 duplicate attack ids#306

Merged
isaisabel merged 5 commits into
developfrom
feature/#304-duplicate-attack-ids
Jun 2, 2021
Merged

Feature/#304 duplicate attack ids#306
isaisabel merged 5 commits into
developfrom
feature/#304-duplicate-attack-ids

Conversation

@IanDavila

Copy link
Copy Markdown
Contributor

Description of what has changed

Added support for more than one object with the same STIX or ATT&CK ID on STIX bundles. Website will display the most recently modified object depending on the deprecation status.

Issues addressed by pull request

Closes #304.

@IanDavila IanDavila requested a review from isaisabel May 27, 2021 17:41

@isaisabel isaisabel left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Proposed a performance improvement, but I like the overall approach taken currently. Should hopefully not be to hard to adapt to the proposed improvement.

Comment thread modules/util/stixhelpers.py Outdated
Comment thread modules/util/stixhelpers.py Outdated
Comment thread modules/util/stixhelpers.py Outdated
@isaisabel isaisabel linked an issue Jun 1, 2021 that may be closed by this pull request
@IanDavila IanDavila requested a review from isaisabel June 1, 2021 16:17
Comment on lines +224 to +249
def get_domain_resources(types):
# Returns sorted list by name of domain resources by given type list
# Builds list from unique ATT&CK IDs

def grab_filtered_list_by_type(domain, stix_type):
return ms[domain['name']].query([
stix2.Filter('type', '=', stix_type),
stix2.Filter('revoked', '=', False)
])

# Track objects by STIX ID
stix_objs = {}
# Track objects by ATT&CK ID
attack_id_objs = {}
for domain in site_config.domains:
if domain['deprecated']: continue

for stix_type in types:
curr_list = grab_filtered_list_by_type(domain, stix_type)

for val in curr_list:
add_replace_or_ignore(stix_objs, attack_id_objs, val)

# Convert into list of values
resource_list = [attack_id_objs[key] for key in attack_id_objs]
return sorted(resource_list, key=lambda k: k['name'].lower())

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This helper function is an excellent addition!

@isaisabel isaisabel merged commit 07c3254 into develop Jun 2, 2021
@jondricek jondricek deleted the feature/#304-duplicate-attack-ids branch April 7, 2022 17:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Duplicate ATT&CK IDs

2 participants