Cannot download threat info through neither docker's "bootstrap" nor "build_bron.py" manually.

[jayzheng98]

bootstrap logs:

raise ConnectionError(e, request=request)
requests.exceptions.ConnectionError: HTTPSConnectionPool(host='raw.githubusercontent.com', port=443): Max retries exceeded with url: /mitre/cti/master/enterprise-attack/enterprise-attack.json (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f861a1fe6d0>: Failed to establish a new connection: [Errno 111] Connection refused'))

[hembergerik]

This seems to be a network connection error when downloading threat data. Hopefully it will work if you try again.
You can check if the URL hosting the MITRE ATT&CK enterprise matrix data is accessible by e.g. pasting this URL in your browser https://github.com/mitre/cti/raw/master/enterprise-attack/enterprise-attack.json (This is the ENTERPRISE_ATTACK_URL in download_threat_information/download_threat_data.py )

[jayzheng98]

Thank you for your reply! Actually, after several times of network check and retry, I still cannot run the open source code. However, I did find another way to construct the BRON cybersecurity graph, that is to download all the "COLLECTIONS" json files from your open ArangoDB web page (http://bron.alfa.csail.mit.edu:8529) one by one manually, and then upload them to my local ArangoDB with types and relationships obtained from your "BRONGraph".
Now I am wondering if this method can achieve the same effect as running your open source code? Can my local graph be useful for subsequent experiments?

[hembergerik]

Yes, they are the end result of running the build_bron.py.

• You can import these collections to your own ArangoDb instance.
• We have also sometimes use the json files directly to do analysis on as well.

[shaileshmeivel]

I was able to download the thread data by placing the build_bron.py file outside the tutorials folder. But the data got downloaded only after 3-4 tries.

[hembergerik]

• I would first check if there is a network connection error when downloading threat data.

  • E.g. You can check if the URL hosting the data is accessible by pasting the URLs it tries to connect to e.g.

    BRON/download_threat_information/download_threat_data.py

    Line 21 in a45d063

    CAPEC_XML_URL = "http://capec.mitre.org/data/xml/capec_latest.xml"

• Do you have any details of where it failed?

[shaileshmeivel]

No I don't have details of where it failed because I downloaded these files 2-3 months back