Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: error in T1168 technique url #65

Closed
wants to merge 1 commit into from
Closed

fix: error in T1168 technique url #65

wants to merge 1 commit into from

Conversation

cvandeplas
Copy link

The URL of technique T1168 pointed to the mitigations path and not the techniques one.
This PR is to correct this small error that appeared in the latest update of ATT&CK.

@isaisabel
Copy link
Member

Hi @cvandeplas,

The SDO this pull request is addressing is a deprecated mitigation (in STIX terms, a course-of-action), not a technique.

Prior to the July 2019 ATT&CK update (also known as ATT&CK-v5.0) mitigation objects in the Enterprise domain had 1:1 relationships with techniques, and were kept on the technique pages. Thus the external reference URL pointing to a technique page, and the ID which implies that it is a technique (even though from a STIX perspective it is not). You can see this behavior in action via our previous versions archive here.

In the July 2019 update referenced above, we refactored our enterprise mitigations to support many:many relationships with techniques. This update involved deprecating all of the old enterprise course-of-action objects in favor of the new mitigations.

Deprecated objects (marked with the x_mitre_deprecated field) are no longer supported by ATT&CK. They are kept in our repo for the purposes of historical record and to avoid breaking any code that may rely on those specific objects. However, their external references URLs are not guaranteed to lead to live pages on our website, and we do not provide updates to their content. In the case of the mitigations such as T1168 they were removed from the website altogether.

I am closing this pull request without merging because of the following reasons:

  1. We do not update or maintain deprecated objects, and the object being patched in your pull request is deprecated.
  2. The object in question is a mitigation, not a technique. If it were to be found on the ATT&CK site, it would belong in the /mitigations/ directory, not the /techniques/ directory as it was prior to the aforementioned July 2019 update.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants