ReaQta Use TTP Custom Object #1473
Conversation
stix_shifter_modules/reaqta/stix_translation/json/to_stix_map.json
Outdated
Show resolved
Hide resolved
| @@ -109,7 +110,8 @@ | |||
| "network_ref.src_ref.value": ["ip"], | |||
| "parent_process_ref.pid": ["service.ppid"], | |||
| "process_ref.pid": ["wmi.clientPid"], | |||
| "user_ref.user_id": [] | |||
| "user_ref.user_id": [], | |||
There was a problem hiding this comment.
Why is this mapping to an empty list of fields?
There was a problem hiding this comment.
This is what it was, I just delete the comma at the end to make it valid Json.
There was a problem hiding this comment.
It should just be removed, it shouldn't be there because it's not actually mapping to anything.
Codecov ReportPatch coverage:
Additional details and impacted files@@ Coverage Diff @@
## develop #1473 +/- ##
===========================================
- Coverage 85.18% 85.18% -0.01%
===========================================
Files 679 679
Lines 53153 53149 -4
===========================================
- Hits 45279 45275 -4
Misses 7874 7874
☔ View full report in Codecov by Sentry. |
JingqiuDu
force-pushed
the
ReaQtaUseTTPCustomObject
branch
2 times, most recently
from
92134e6
to
e99e779
Compare
JingqiuDu
force-pushed
the
ReaQtaUseTTPCustomObject
branch
from
e99e779
to
beca23f
Compare
| @@ -1824,8 +1824,8 @@ | |||
| "object": "x-reaqta" | |||
| }, | |||
| "tactics": { | |||
| "key": "x-reaqta-event.tactics", | |||
| "object": "x-reaqta" | |||
| "key": "x-ibm-finding.ttp_tagging_refs", | |||
There was a problem hiding this comment.
You need to also create an x-ibm-ttp-tagging object when the tactics and technique fields are in the native results. This is the object that the x-ibm-finding.ttp_tagging_refs will reference. For an example of referencing, take a look at how the x-oca-asset.ip_refs references the src_ip in this same file.
| "tactics": [ | ||
| { | ||
| "key": "x-ibm-finding.ttp_tagging_refs", | ||
| "object": "x-ibm-finding" |
There was a problem hiding this comment.
Since this is a reference key, you also need to include a "references" property that maps to the ttp object. In this case it would be "references": ["x-ibm-ttp-tagging"]
stix_shifter_modules/reaqta/stix_translation/json/stix_2_1/to_stix_map.json
Show resolved
Hide resolved
| "tactics": [ | ||
| { | ||
| "key": "x-ibm-finding.ttp_tagging_refs", | ||
| "object": "x-ibm-finding" |
There was a problem hiding this comment.
missing references property
| "technique": [ | ||
| { | ||
| "key": "x-ibm-finding.ttp_tagging_refs", | ||
| "object": "x-ibm-finding" |
There was a problem hiding this comment.
missing references property
JingqiuDu
force-pushed
the
ReaQtaUseTTPCustomObject
branch
from
a43dab7
to
e9e3eef
Compare
No description provided.