tmc

Threat Mapping Catalogue

​

Requirements

• python3 (3.7+)
• Flask
• Sqlite
• TRAM adaptation : (https://github.com/fierytermite/tram-1) [forked from fixed version by @cyb3rR4v3n
• Attack Navigator adaptation : (https://github.com/fierytermite/attack-navigator)

For the navigator, you'll need to clone the branch 'tmc' in order to make it work:

git clone --branch tmc https://github.com/fierytermite/attack-navigator

Note!! In order to the Navigator Adaptation to work properly you would have to work around CORS blocked by policy. You can get away easily by using Chrome browser extension Allow CORS: Access-Control-Allow-Origin. Keep in mind that CORS blocks are implemented for security reasons, so allow them wisely. You can still use TRAM and all other functionality without it.

Installation

Clone this github repository and from its root folder install its requirements:

pip install -r requirements.txt

You can set the enviornment in which the app is running by setting the FLASK_ENV variable to development or production:

export FLASK_ENV=<environment varible>

Then run the following commands:

export FLASK_APP=tmc
flask init-db
flask run

Once the server has started, access the application through localhost:5000. You will need to register an user and log in in order to use the application.

To load the database with the data from ATT&CK access the following path. Please be patiente, since this operation really takes a while (aprox 1h 30m, depending on your internet connection):

localhost:5000/first-time

Keep in mind that the next time you want to run the application, you don't have to initilizate the database, since doing it will erase any content loaded in it. Repeat the previous steps without that command:

export FLASK_ENV=<environment varible>
export FLASK_APP=tmc
flask run

Making the APP public

If you prefer, you can change the port and make the app publicly available by running the following command:

flask run -p <number> -h 0.0.0.0

Author

• Valentina Palacin @fierytermite

License: MIT License

MIT License

Copyright (c) 2021 Valentina Palacin

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

TO-DOs

• Add Industry List
• Add mapping from TRAM
• Link TMC with TRAM
• Link TMC with Navigator
• Automatically download the mapping from Navigator as SVG
• Export as CSV function
• Edit database views
• Dockerize project