New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Revoked entries included in MITRE galaxies #732

Open

jsman opened this issue Jul 11, 2022 · 0 comments · May be fixed by #733

Assignees

jsman commented Jul 11, 2022

The MITRE galaxies contain revoked entries. This causes multiple attack patterns to be displayed more than once in the matix.

As an example, in March 2020:
Registry Run Keys / Startup Folder - T1547.001 became a sub-technique and Registry Run Keys / Startup Folder - T1060 was revoked.

https://attack.mitre.org/resources/updates/updates-march-2020/index.html

Both are contained in the latest MISP galaxy and shown in the MISP matrix.

I believe when bumping the galaxy to the latest released MITRE version, revoked entries should no longer be included.

jsman linked a pull request

that will close this issue

Fix revoked clusters being included in the galaxy #733

Open

cvandeplas self-assigned this

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment