anti
d743d38cac
Replace the hand-maintained TECHNIQUE_NAMES dict (pinned to v15.1) with a runtime loader that reads the official enterprise-attack-N.json STIX bundle. Version bumps now require only updating attack_version.py; sub-technique parents, tactic IDs, and kill-chain phases all come from MITRE's published data. - decnet/ttp/attack_version.py pins version 19.0 + sha256 + URL - decnet/ttp/attack_stix.py is the lazy STIX loader. Resolution order: DECNET_ATTACK_BUNDLE env -> ~/.cache/decnet/attack/ -> fetch from the pinned MITRE GitHub URL. SHA-256 verified before parse; mismatch fails closed. - decnet/ttp/attack_catalog.py collapses to a shim re-exporting technique_name() so the ~9 router/repo call sites don't churn. - python -m decnet.ttp.attack_stix fetch warms the cache and can print sha256 for version-bump workflows. - test_attack_catalog.py now asserts every rule-emitted ID resolves in the loaded bundle (same contract, real source) and exercises the SHA-256-mismatch fail-closed path.
37 lines
1.2 KiB
Python
37 lines
1.2 KiB
Python
"""Pinned MITRE ATT&CK Enterprise STIX bundle version.
|
|
|
|
Bumping ``ATTACK_BUNDLE_VERSION`` is the *only* code change required
|
|
to track a new ATT&CK release — all technique/tactic names and
|
|
sub-technique parents are loaded from the bundle at runtime via
|
|
``decnet.ttp.attack_stix``. The hash is verified after fetch; a
|
|
mismatch refuses to load (fail-closed, mirroring the bundle-include
|
|
discipline used elsewhere in DECNET).
|
|
|
|
To regenerate the hash after a version bump::
|
|
|
|
.311/bin/python -m decnet.ttp.attack_stix fetch --print-sha
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
from typing import Final
|
|
|
|
ATTACK_BUNDLE_VERSION: Final[str] = "19.0"
|
|
|
|
# sha256 of the canonical MITRE-published enterprise-attack-19.0.json
|
|
# from https://github.com/mitre-attack/attack-stix-data.
|
|
ATTACK_BUNDLE_SHA256: Final[str] = (
|
|
"df520ea0775a57db7bff760145b02fed89290802913e056b7ed5970b02f3626a"
|
|
)
|
|
|
|
# Raw download URL for the pinned version.
|
|
ATTACK_BUNDLE_URL: Final[str] = (
|
|
"https://raw.githubusercontent.com/mitre-attack/attack-stix-data"
|
|
f"/master/enterprise-attack/enterprise-attack-{ATTACK_BUNDLE_VERSION}.json"
|
|
)
|
|
|
|
__all__ = [
|
|
"ATTACK_BUNDLE_SHA256",
|
|
"ATTACK_BUNDLE_URL",
|
|
"ATTACK_BUNDLE_VERSION",
|
|
]
|