Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Mitre attack playbook fix - Added an input existence validation. #21708

Merged
merged 3 commits into from Oct 18, 2022
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
Expand Up @@ -24,8 +24,8 @@ tasks:
view: |-
{
"position": {
"x": 290,
"y": -100
"x": 120,
"y": -320
}
}
note: false
Expand All @@ -35,12 +35,13 @@ tasks:
quietmode: 0
isoversize: false
isautoswitchedtoquietmode: false
continueonerrortype: ""
'2':
id: '2'
taskid: 71ead20e-81e4-41ad-8228-152b9308eec0
taskid: c06c8807-6cce-4048-8f8c-6f4fa6a0c274
type: regular
task:
id: 71ead20e-81e4-41ad-8228-152b9308eec0
id: c06c8807-6cce-4048-8f8c-6f4fa6a0c274
version: -1
name: Get MITRE name
description: Gets the Attack Pattern value from the Attack Pattern ID.
Expand All @@ -53,14 +54,17 @@ tasks:
- '6'
scriptarguments:
attack_ids:
simple: ${inputs.TechniqueID}
complex:
root: inputs.TechniqueID
transformers:
- operator: uniq
reputationcalc: 2
separatecontext: false
view: |-
{
"position": {
"x": 500,
"y": 210
"x": 550,
"y": 150
}
}
note: false
Expand All @@ -70,12 +74,13 @@ tasks:
quietmode: 0
isoversize: false
isautoswitchedtoquietmode: false
continueonerrortype: ""
'3':
id: '3'
taskid: 255f9603-fbae-493b-8b36-e5bf3cd68698
taskid: e8ae624f-69bd-4cb7-8467-37ed23b8f308
type: regular
task:
id: 255f9603-fbae-493b-8b36-e5bf3cd68698
id: e8ae624f-69bd-4cb7-8467-37ed23b8f308
version: -1
name: Get MITRE details
description: Looks up the indicator reputation.
Expand All @@ -88,14 +93,18 @@ tasks:
- '5'
scriptarguments:
attack_pattern:
simple: ${MITREATTACK.value}
complex:
root: MITREATTACK
accessor: value
transformers:
- operator: uniq
reputationcalc: 2
separatecontext: false
view: |-
{
"position": {
"x": 630,
"y": 590
"x": 740,
"y": 490
}
}
note: false
Expand All @@ -105,6 +114,7 @@ tasks:
quietmode: 0
isoversize: false
isautoswitchedtoquietmode: false
continueonerrortype: ""
'5':
id: '5'
taskid: 78c61601-dac1-4c2e-86f8-d868beab2f9b
Expand All @@ -121,8 +131,8 @@ tasks:
view: |-
{
"position": {
"x": 290,
"y": 760
"x": 120,
"y": 660
}
}
note: false
Expand All @@ -132,6 +142,7 @@ tasks:
quietmode: 0
isoversize: false
isautoswitchedtoquietmode: false
continueonerrortype: ""
'6':
id: '6'
taskid: f2c805ba-07f6-4550-8fdb-c03098941b75
Expand All @@ -143,7 +154,7 @@ tasks:
type: condition
iscommand: false
brand: ''
description: ''
description: 'Are there techniques?'
nexttasks:
'#default#':
- '5'
Expand All @@ -161,8 +172,8 @@ tasks:
view: |-
{
"position": {
"x": 500,
"y": 380
"x": 550,
"y": 320
}
}
note: false
Expand All @@ -172,6 +183,7 @@ tasks:
quietmode: 0
isoversize: false
isautoswitchedtoquietmode: false
continueonerrortype: ""
'7':
id: '7'
taskid: c004b40d-2957-4ead-88f0-c63a111947bc
Expand All @@ -189,7 +201,7 @@ tasks:
no:
- '5'
yes:
- '2'
- "8"
scriptarguments:
brandname:
simple: MITRE ATT&CK v2
Expand All @@ -199,8 +211,50 @@ tasks:
view: |-
{
"position": {
"x": 290,
"y": 30
"x": 120,
"y": -190
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
isoversize: false
isautoswitchedtoquietmode: false
continueonerrortype: ""
"8":
id: "8"
taskid: e013809e-88cf-4415-87cf-32fe291b92a7
type: condition
task:
id: e013809e-88cf-4415-87cf-32fe291b92a7
version: -1
name: Are MITRE Attack Technique IDs provided?
type: condition
description: Are MITRE Attack Technique IDs provided?
iscommand: false
brand: ""
nexttasks:
'#default#':
- "5"
"yes":
- "2"
separatecontext: false
conditions:
- label: "yes"
condition:
- - operator: isNotEmpty
left:
value:
simple: inputs.TechniqueID
iscontext: true
continueonerrortype: ""
view: |-
{
"position": {
"x": 340,
"y": -20
}
}
note: false
Expand All @@ -215,10 +269,10 @@ view: |-
"linkLabelsPosition": {},
"paper": {
"dimensions": {
"height": 925,
"width": 720,
"x": 290,
"y": -100
"height": 1045,
"width": 1000,
"x": 120,
"y": -320
}
}
}
Expand All @@ -238,3 +292,6 @@ outputs:
tests:
- FeedMitreAttackv2_test
fromversion: 6.2.0
contentitemexportablefields:
contentitemfields: {}
system: true
4 changes: 4 additions & 0 deletions Packs/FeedMitreAttackv2/ReleaseNotes/1_1_4.md
@@ -0,0 +1,4 @@

#### Playbooks
##### Mitre Attack - Extract Technique Information From ID
Added an input existence validation.
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
2 changes: 1 addition & 1 deletion Packs/FeedMitreAttackv2/pack_metadata.json
Expand Up @@ -2,7 +2,7 @@
"name": "MITRE ATT&CK",
"description": "Fetches indicators from MITRE ATT&CK.",
"support": "xsoar",
"currentVersion": "1.1.3",
"currentVersion": "1.1.4",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down