testing

automated_detection_testing/detection_service.py

@@ -156,7 +156,7 @@ def main(args):
                     detection_obj['tags']['dataset'] = datasets
 
                 with open(file_path, 'w') as f:
-                    yaml.dump(detection_obj, f)
+                    yaml.dump(detection_obj, f, sort_keys=False)
 
                 changed_file_path = 'detections/' + test['detection'].replace(' ', '_').replace('-','_').replace('.','_').replace('/','_').lower() + '.yml'
                 security_content_repo_obj.index.add([changed_file_path])

bin/converter_v2_v3.py

@@ -4,7 +4,6 @@ import yaml
 import glob
 import re
 
-from collections import OrderedDict
 from attackcti import attack_client
 
 
@@ -101,7 +100,7 @@ def generate_content():
         if 'asset_type' in orig_dict:
             tag_dict['asset_type'] = orig_dict['asset_type']
         new_dict['tags'] = tag_dict
-        ordered_new_dict = OrderedDict(new_dict.items())
+
         new_file_name = new_dict['name'].replace(' ', '_').replace('-','_').replace('.','_').replace('/','_').lower()
         with open('detections/' + new_file_name + '.yml', 'w+' ) as outfile:
 	           yaml.dump( new_dict , outfile , default_flow_style=False, sort_keys=False)

detections/system_information_discovery_detection.yml

@@ -19,12 +19,9 @@ tags:
   analytics_story:
   - Discovery Techniques
   asset_type: Windows
-  automated_detection_testing: passed
   cis20:
   - CIS 6
   - CIS 8
-  dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1082/windows-sysmon.log
   kill_chain_phases:
   - Actions on Objectives
   mitre_attack_id: