Skip to content

Commit 0a5d547

Browse files
clemillerclemiller
committed
fix: add missing data_component_name to log source permutations array
1 parent 8de38cf commit 0a5d547

File tree

5 files changed

+92
-31
lines changed

5 files changed

+92
-31
lines changed

‎docs/SPEC.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -445,6 +445,7 @@ The `log_source_permutation` object defines platform-specific collection configu
445445
| --------- | ------ | -------------------------------------------------------------------- |
446446
| `name` | string | Log source identifier (e.g., "sysmon", "auditd") |
447447
| `channel` | string | Specific log channel or event type (e.g., "1" for Sysmon Process Creation) |
448+
| `data_component_name` | string | Name of the specific data component. |
448449

449450
**Example:** A single log source for 'Process Creation' might contain permutations for:
450451
- Windows: (name: "sysmon", channel: "1")

‎examples/sdo/log-source.example.ts‎

Lines changed: 46 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,13 @@ const validLogSource = {
2929
"x_mitre_log_source_permutations": [
3030
{
3131
"name": "sysmon",
32-
"channel": "EventCode=10"
32+
"channel": "EventCode=10",
33+
"data_component_name": "Process Creation"
3334
},
3435
{
3536
"name": "auditd:SYSCALL",
36-
"channel": "ptrace"
37+
"channel": "ptrace",
38+
"data_component_name": "Process Creation"
3739
}
3840
]
3941
};
@@ -83,15 +85,18 @@ const validLogSourceMultiplePermutations = {
8385
"x_mitre_log_source_permutations": [
8486
{
8587
"name": "Security",
86-
"channel": "Security"
88+
"channel": "Security",
89+
"data_component_name": "Process Creation"
8790
},
8891
{
8992
"name": "System",
90-
"channel": "System"
93+
"channel": "System",
94+
"data_component_name": "Process Creation"
9195
},
9296
{
9397
"name": "Application",
94-
"channel": "Application"
98+
"channel": "Application",
99+
"data_component_name": "Process Creation"
95100
}
96101
]
97102
};
@@ -190,11 +195,13 @@ const invalidLogSourceDuplicatePermutations = {
190195
"x_mitre_log_source_permutations": [
191196
{
192197
"name": "Security",
193-
"channel": "Security"
198+
"channel": "Security",
199+
"data_component_name": "Process Creation"
194200
},
195201
{
196202
"name": "Security",
197-
"channel": "Security"
203+
"channel": "Security",
204+
"data_component_name": "Process Creation"
198205
}
199206
]
200207
};
@@ -227,15 +234,18 @@ const validLogSourceSameNameDifferentChannels = {
227234
"x_mitre_log_source_permutations": [
228235
{
229236
"name": "Sysmon",
230-
"channel": "EventCode=1"
237+
"channel": "EventCode=1",
238+
"data_component_name": "Process Creation"
231239
},
232240
{
233241
"name": "Sysmon",
234-
"channel": "EventCode=3"
242+
"channel": "EventCode=3",
243+
"data_component_name": "Process Creation"
235244
},
236245
{
237246
"name": "Sysmon",
238-
"channel": "EventCode=10"
247+
"channel": "EventCode=10",
248+
"data_component_name": "Process Creation"
239249
}
240250
]
241251
};
@@ -251,7 +261,8 @@ const invalidLogSourceEmptyPermutationName = {
251261
"x_mitre_log_source_permutations": [
252262
{
253263
"name": "",
254-
"channel": "Security"
264+
"channel": "Security",
265+
"data_component_name": "Process Creation"
255266
}
256267
]
257268
};
@@ -275,7 +286,8 @@ const invalidLogSourceEmptyPermutationChannel = {
275286
"x_mitre_log_source_permutations": [
276287
{
277288
"name": "Security",
278-
"channel": ""
289+
"channel": "",
290+
"data_component_name": "Process Creation"
279291
}
280292
]
281293
};
@@ -319,11 +331,13 @@ const validMobileLogSource = {
319331
"x_mitre_log_source_permutations": [
320332
{
321333
"name": "logcat",
322-
"channel": "system"
334+
"channel": "system",
335+
"data_component_name": "Process Creation"
323336
},
324337
{
325338
"name": "logcat",
326-
"channel": "main"
339+
"channel": "main",
340+
"data_component_name": "Process Creation"
327341
}
328342
]
329343
};
@@ -359,15 +373,18 @@ const validMultiDomainLogSource = {
359373
"x_mitre_log_source_permutations": [
360374
{
361375
"name": "pcap",
362-
"channel": "network"
376+
"channel": "network",
377+
"data_component_name": "Process Creation"
363378
},
364379
{
365380
"name": "netflow",
366-
"channel": "flow"
381+
"channel": "flow",
382+
"data_component_name": "Process Creation"
367383
},
368384
{
369385
"name": "firewall",
370-
"channel": "traffic"
386+
"channel": "traffic",
387+
"data_component_name": "Process Creation"
371388
}
372389
]
373390
};
@@ -424,11 +441,13 @@ const validLogSourceSpecialChars = {
424441
"x_mitre_log_source_permutations": [
425442
{
426443
"name": "Security/Application-Logs_2024",
427-
"channel": "Microsoft-Windows-Security-Auditing/Operational"
444+
"channel": "Microsoft-Windows-Security-Auditing/Operational",
445+
"data_component_name": "Process Creation"
428446
},
429447
{
430448
"name": "EventLog:Security",
431-
"channel": "EventID=4624"
449+
"channel": "EventID=4624",
450+
"data_component_name": "Process Creation"
432451
}
433452
]
434453
};
@@ -502,19 +521,23 @@ const validLogSourceComplexPermutations = {
502521
"x_mitre_log_source_permutations": [
503522
{
504523
"name": "sysmon:1",
505-
"channel": "process_creation"
524+
"channel": "process_creation",
525+
"data_component_name": "Process Creation"
506526
},
507527
{
508528
"name": "auditd:SYSCALL",
509-
"channel": "execve"
529+
"channel": "execve",
530+
"data_component_name": "Process Creation"
510531
},
511532
{
512533
"name": "powershell:4104",
513-
"channel": "script_block"
534+
"channel": "script_block",
535+
"data_component_name": "Process Creation"
514536
},
515537
{
516538
"name": "wmi:19",
517-
"channel": "wmi_event"
539+
"channel": "wmi_event",
540+
"data_component_name": "Process Creation"
518541
}
519542
]
520543
};

‎src/generator/index.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -214,6 +214,7 @@ const minimalLogSource = {
214214
{
215215
name: 'Security',
216216
channel: 'Security',
217+
data_component_name: 'Security',
217218
},
218219
],
219220
};

‎src/schemas/sdo/log-source.schema.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ export const xMitreLogSourcePermutationsSchema = z
2020
z.object({
2121
name: z.string().nonempty(),
2222
channel: z.string().nonempty(),
23+
data_component_name: z.string().nonempty(),
2324
}),
2425
)
2526
.nonempty()

‎test/objects/log-source.test.ts‎

Lines changed: 43 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,7 @@
11
import { v4 as uuidv4 } from 'uuid';
22
import { describe, expect, it } from 'vitest';
33
import { createSyntheticStixObject } from '../../src/generator';
4-
import {
5-
type ExternalReferences
6-
} from '../../src/schemas/common/index';
4+
import { type ExternalReferences } from '../../src/schemas/common/index';
75
import { type LogSource, logSourceSchema } from '../../src/schemas/sdo/log-source.schema';
86

97
describe('logSourceSchema', () => {
@@ -22,10 +20,12 @@ describe('logSourceSchema', () => {
2220
{
2321
name: 'Security',
2422
channel: 'Security',
23+
data_component_name: 'Process Creation',
2524
},
2625
{
2726
name: 'System',
2827
channel: 'System',
28+
data_component_name: 'Process Creation',
2929
},
3030
],
3131
};
@@ -39,14 +39,17 @@ describe('logSourceSchema', () => {
3939
{
4040
name: 'Application',
4141
channel: 'Application',
42+
data_component_name: 'Process Creation',
4243
},
4344
{
4445
name: 'Security',
4546
channel: 'Security',
47+
data_component_name: 'Process Creation',
4648
},
4749
{
4850
name: 'System',
4951
channel: 'System',
52+
data_component_name: 'Process Creation',
5053
},
5154
],
5255
};
@@ -109,31 +112,55 @@ describe('logSourceSchema', () => {
109112
it('should reject permutations with empty name', () => {
110113
const invalidObject = {
111114
...minimalLogSource,
112-
x_mitre_log_source_permutations: [{ name: '', channel: 'Security' }],
115+
x_mitre_log_source_permutations: [
116+
{ name: '', channel: 'Security', data_component_name: 'Security' },
117+
],
113118
};
114119
expect(() => logSourceSchema.parse(invalidObject)).toThrow();
115120
});
116121

117122
it('should reject permutations with empty channel', () => {
118123
const invalidObject = {
119124
...minimalLogSource,
120-
x_mitre_log_source_permutations: [{ name: 'Security', channel: '' }],
125+
x_mitre_log_source_permutations: [
126+
{ name: 'Security', channel: '', data_component_name: 'Security' },
127+
],
128+
};
129+
expect(() => logSourceSchema.parse(invalidObject)).toThrow();
130+
});
131+
132+
it('should reject permutations with empty data component name', () => {
133+
const invalidObject = {
134+
...minimalLogSource,
135+
x_mitre_log_source_permutations: [
136+
{ name: 'Security', channel: 'Security', data_component_name: '' },
137+
],
121138
};
122139
expect(() => logSourceSchema.parse(invalidObject)).toThrow();
123140
});
124141

125142
it('should reject permutations missing name', () => {
126143
const invalidObject = {
127144
...minimalLogSource,
128-
x_mitre_log_source_permutations: [{ channel: 'Security' }],
145+
x_mitre_log_source_permutations: [
146+
{ channel: 'Security', data_component_name: 'Security' },
147+
],
129148
};
130149
expect(() => logSourceSchema.parse(invalidObject)).toThrow();
131150
});
132151

133152
it('should reject permutations missing channel', () => {
134153
const invalidObject = {
135154
...minimalLogSource,
136-
x_mitre_log_source_permutations: [{ name: 'Security' }],
155+
x_mitre_log_source_permutations: [{ name: 'Security', data_component_name: 'Security' }],
156+
};
157+
expect(() => logSourceSchema.parse(invalidObject)).toThrow();
158+
});
159+
160+
it('should reject permutations missing data component name', () => {
161+
const invalidObject = {
162+
...minimalLogSource,
163+
x_mitre_log_source_permutations: [{ name: 'Security', channel: 'Security' }],
137164
};
138165
expect(() => logSourceSchema.parse(invalidObject)).toThrow();
139166
});
@@ -211,10 +238,12 @@ describe('logSourceSchema', () => {
211238
{
212239
name: 'Security',
213240
channel: 'Security',
241+
data_component_name: 'Security',
214242
},
215243
{
216244
name: 'Security',
217245
channel: 'Security',
246+
data_component_name: 'Security',
218247
},
219248
],
220249
};
@@ -230,10 +259,12 @@ describe('logSourceSchema', () => {
230259
{
231260
name: 'Security',
232261
channel: 'Security',
262+
data_component_name: 'Security',
233263
},
234264
{
235265
name: 'Security',
236266
channel: 'Application',
267+
data_component_name: 'Security',
237268
},
238269
],
239270
};
@@ -247,24 +278,27 @@ describe('logSourceSchema', () => {
247278
{
248279
name: 'Security',
249280
channel: 'EventLog',
281+
data_component_name: 'Security',
250282
},
251283
{
252284
name: 'Application',
253285
channel: 'EventLog',
286+
data_component_name: 'Security',
254287
},
255288
],
256289
};
257290
expect(() => logSourceSchema.parse(logSourceWithSameChannel)).not.toThrow();
258291
});
259292

260-
it('should handle very long permutation names and channels', () => {
293+
it('should handle very long permutation names, channels, and data component names', () => {
261294
const longString = 'A'.repeat(1000);
262295
const logSourceWithLongStrings: LogSource = {
263296
...minimalLogSource,
264297
x_mitre_log_source_permutations: [
265298
{
266299
name: longString,
267300
channel: longString,
301+
data_component_name: longString,
268302
},
269303
],
270304
};
@@ -278,6 +312,7 @@ describe('logSourceSchema', () => {
278312
{
279313
name: 'Security/Application-Logs_2024',
280314
channel: 'Microsoft-Windows-Security-Auditing/Operational',
315+
data_component_name: 'Security',
281316
},
282317
],
283318
};

0 commit comments

Comments
 (0)