Cleanup mitre actors and techniques #363
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
cleanup
and uniqueness enforcement for groups and mitre tactics. The errors still are not high quality and will take some time to fix.
overlapping mitre id type and subtypes
… particularly useful in site gen.
so that new field is not serialized
introduced in previous commit. forgot to actually assign mitre_attack_enrichments to self after resolving them
back into an error
patel-bhavin
approved these changes
Feb 12, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add a property to detection tags called
detection.tags.unique_mitre_attack_groupswhich can be used to deduplicate all the groups that occur across all the MitreEnrichments which are loaded dynamically from the list of Mitre Attack IDs.Secondly, we add validation so that a MITRE ID and Subtype cannot exist and throw a descriptive exception. For example, the following is no longer allowed:
But all of the following options are acceptable
See the following PR which updates around 1000 pieces of content to conform to this new restriction:
splunk/security_content#3323