From 0db46f89dc1bc1aedbe8c7c020f52bc41f56bc97 Mon Sep 17 00:00:00 2001 From: jzsplunk Date: Tue, 1 Sep 2020 17:55:14 -0700 Subject: [PATCH] [TR-82] first cut of validation logic for risk scoring. --- bin/validate.py | 22 ++++++++++++++++++++++ spec/detections.spec.json | 9 +++++++++ 2 files changed, 31 insertions(+) diff --git a/bin/validate.py b/bin/validate.py index 44540b146e..0d54485fd7 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -121,6 +121,28 @@ def validate_standard_fields(object, uuids): except ValueError: errors.append("ERROR: Incorrect date format, should be YYYY-MM-DD for object: %s" % object['name']) + # logic for handling risk related tags which are a triple of k/v pairs + # risk_object, risk_object_type and risk_score + # the first two fields risk_object, and risk_object_type are an enum of fixed values + # defined by ESCU risk scoring + if 'risk_object' in object: + try: + object['risk_object'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: description not ascii for object: %s" % object['name']) + + if 'risk_object_type' in object: + try: + object['risk_object_type'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: description not ascii for object: %s" % object['name']) + + if 'risk_object_score' in object: + try: + object['risk_score'].isnumeric() + except UnicodeEncodeError: + errors.append("ERROR: description not numeric value for object: %s" % object['name']) + return errors, uuids diff --git a/spec/detections.spec.json b/spec/detections.spec.json index 9f9fc25482..9fe66a1f61 100644 --- a/spec/detections.spec.json +++ b/spec/detections.spec.json @@ -106,6 +106,15 @@ "examples": [ { "analytics_story": "credential_dumping", + "kill_chain_phases": "Action on Objectives", + "mitre_attack_id": "T1078.004", + "cis20": "CIS 13", + "nist": "DE.DP", + "security domain": "network", + "asset_type": "AWS Instance", + "risk_object": "user", + "risk_object_type": "network_artifacts", + "risk score": "60", "custom_key": "custom_value" } ],