From c247d2cdd4a800fb373ef723683f3fce53d974ed Mon Sep 17 00:00:00 2001 From: Danny Leung Date: Thu, 2 Jun 2022 21:03:36 -0700 Subject: [PATCH 1/3] PEX-76: remove detection_names; modify detections to only contain name attribute --- .../adapter/obj_to_json_adapter.py | 1 - .../builder/security_content_story_builder.py | 6 ++---- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_json_adapter.py b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_json_adapter.py index 183b404d6e..0e6dce1880 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_json_adapter.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_json_adapter.py @@ -36,7 +36,6 @@ class ObjToJsonAdapter(Adapter): obj_array.append(story.dict(exclude_none=True, exclude = { - "detections": True, "investigations": True } )) diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py index 1518b69f31..2fd3fcc290 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py @@ -29,7 +29,6 @@ class SecurityContentStoryBuilder(StoryBuilder): return self.story def addDetections(self, detections: list) -> None: - matched_detection_names = [] matched_detections = [] mitre_attack_enrichments = [] mitre_attack_tactics = set() @@ -40,8 +39,8 @@ class SecurityContentStoryBuilder(StoryBuilder): if detection: for detection_analytic_story in detection.tags.analytic_story: if detection_analytic_story == self.story.name: - matched_detection_names.append(str('ESCU - ' + detection.name + ' - Rule')) - matched_detections.append(detection) + # SSE-638: detections should only contain the 'name' attribute + matched_detections.append({"name" : detection.name}) datamodels.update(detection.datamodel) if detection.tags.kill_chain_phases: kill_chain_phases.update(detection.tags.kill_chain_phases) @@ -52,7 +51,6 @@ class SecurityContentStoryBuilder(StoryBuilder): if attack_enrichment.mitre_attack_id not in [attack.mitre_attack_id for attack in mitre_attack_enrichments]: mitre_attack_enrichments.append(attack_enrichment) - self.story.detection_names = matched_detection_names self.story.detections = matched_detections self.story.tags.datamodels = sorted(list(datamodels)) self.story.tags.kill_chain_phases = sorted(list(kill_chain_phases)) From 518251e8c83215d690f2fd7a66a37647c183169a Mon Sep 17 00:00:00 2001 From: Danny Leung Date: Mon, 6 Jun 2022 09:51:16 -0700 Subject: [PATCH 2/3] PEX-76: add back the detection_names obj --- .../builder/security_content_story_builder.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py index 2fd3fcc290..d1c3d041dd 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py @@ -29,6 +29,7 @@ class SecurityContentStoryBuilder(StoryBuilder): return self.story def addDetections(self, detections: list) -> None: + matched_detection_names = [] matched_detections = [] mitre_attack_enrichments = [] mitre_attack_tactics = set() @@ -39,6 +40,7 @@ class SecurityContentStoryBuilder(StoryBuilder): if detection: for detection_analytic_story in detection.tags.analytic_story: if detection_analytic_story == self.story.name: + matched_detection_names.append(str('ESCU - ' + detection.name + ' - Rule')) # SSE-638: detections should only contain the 'name' attribute matched_detections.append({"name" : detection.name}) datamodels.update(detection.datamodel) @@ -51,6 +53,7 @@ class SecurityContentStoryBuilder(StoryBuilder): if attack_enrichment.mitre_attack_id not in [attack.mitre_attack_id for attack in mitre_attack_enrichments]: mitre_attack_enrichments.append(attack_enrichment) + self.story.detection_names = matched_detection_names self.story.detections = matched_detections self.story.tags.datamodels = sorted(list(datamodels)) self.story.tags.kill_chain_phases = sorted(list(kill_chain_phases)) From 84420a1912d00020a2cb775fb5ef93f387e9b14c Mon Sep 17 00:00:00 2001 From: Danny Leung Date: Mon, 6 Jun 2022 15:01:26 -0700 Subject: [PATCH 3/3] PEX-76: fix the detections obj to include the J2 docs fields --- .../builder/security_content_story_builder.py | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py index d1c3d041dd..6358830596 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py @@ -41,8 +41,20 @@ class SecurityContentStoryBuilder(StoryBuilder): for detection_analytic_story in detection.tags.analytic_story: if detection_analytic_story == self.story.name: matched_detection_names.append(str('ESCU - ' + detection.name + ' - Rule')) - # SSE-638: detections should only contain the 'name' attribute - matched_detections.append({"name" : detection.name}) + # SSE-638: detections object should at least contain the name attribute. + # We also need a minimal set of the following attributes to satisfy docgen (doc_stories.j2): + # name, source, type, tags.mitre_attack_enrichments.mitre_attack_technique + mitre_attack_enrichments_list = [] + if (detection.tags.mitre_attack_enrichments): + for attack in detection.tags.mitre_attack_enrichments: + mitre_attack_enrichments_list.append({"mitre_attack_technique": attack.mitre_attack_technique}) + tags_obj = {"mitre_attack_enrichments": mitre_attack_enrichments_list} + matched_detections.append({ + "name": detection.name, + "source": detection.source, + "type": detection.type, + "tags": tags_obj + }) datamodels.update(detection.datamodel) if detection.tags.kill_chain_phases: kill_chain_phases.update(detection.tags.kill_chain_phases)