Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature/change tactis and techniques resources #3346

Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
Expand Up @@ -29,6 +29,7 @@ All notable changes to the Wazuh app project will be documented in this file.
- Changed position of Top users on Integrity Monitoring Top 5 user. [#2892](https://github.com/wazuh/wazuh-kibana-app/pull/2892)
- Changed user allow_run_as way of editing. [#3080](https://github.com/wazuh/wazuh-kibana-app/pull/3080)
- Rename some ossec references to Wazuh [#3046](https://github.com/wazuh/wazuh-kibana-app/pull/3046)
- Changed tactis and techniques resources [#3346](https://github.com/wazuh/wazuh-kibana-app/pull/3346)

### Fixed

Expand Down
3 changes: 2 additions & 1 deletion public/components/common/modules/discover/discover.tsx
Expand Up @@ -96,6 +96,7 @@ export const Discover = compose(
query?: { language: "kuery" | "lucene", query: string }
type?: any,
updateTotalHits: Function,
openIntelligence: Function,
includeFilters?: string,
initialColumns: string[],
shareFilterManager: FilterManager,
Expand Down Expand Up @@ -430,7 +431,7 @@ export const Discover = compose(
width = '15%';
}
if (item === 'rule.mitre.id') {
link = (ev, x) => { this.setState({ showMitreFlyout: true, selectedTechnique: x }) };
link = (ev, x, e) => this.props.openIntelligence(e,'techniques',x);
}
if(arrayCompilance.indexOf(item) !== -1) {
width = '30%';
Expand Down
Expand Up @@ -56,6 +56,7 @@ export class FlyoutTechnique extends Component {
props!: {
currentTechniqueData: any
currentTechnique: string
tacticsObject: any
}

filterManager: FilterManager;
Expand Down Expand Up @@ -118,9 +119,9 @@ export class FlyoutTechnique extends Component {
try{
this.setState({loading: true, techniqueData: {}});
const { currentTechnique } = this.props;
const result = await WzRequest.apiReq('GET', '/mitre', {
const result = await WzRequest.apiReq('GET', '/mitre/techniques', {
params: {
q: `id=${currentTechnique}`
q: `references.external_id=${currentTechnique}`
}
});
const rawData = (((result || {}).data || {}).data || {}).affected_items
Expand All @@ -130,36 +131,18 @@ export class FlyoutTechnique extends Component {
}
}

formatTechniqueData (rawData) {
const { platform_name, phase_name} = rawData;
const { name, description, x_mitre_version: version, x_mitre_data_sources, external_references } = rawData.json;

const replaced_external_references = [];
let index_replaced_external_references = 0;
let last_citation_string = '';
const descriptionWithCitations = external_references.reduce((accum, reference) => {
return accum
.replace(new RegExp(`\\(Citation: ${reference.source_name}\\)`,'g'), (token) => {
if(last_citation_string !== token){
index_replaced_external_references++;
replaced_external_references.push({...reference, index: index_replaced_external_references});
last_citation_string = token;
}
return `<a style="vertical-align: super;" rel="noreferrer" class="euiLink euiLink--primary technique-reference-citation-${index_replaced_external_references}">[${String(index_replaced_external_references)}]</a>`;
})
}, description);
this.setState({techniqueData: { name, description: descriptionWithCitations, phase_name, platform_name, version, x_mitre_data_sources, external_references, replaced_external_references }, loading: false })
findTacticName(tactics){
const { tacticsObject } = this.props;
return tactics.map((element) => {
const tactic = Object.values(tacticsObject).find(obj => obj.id === element);
return { id:tactic.references[0].external_id, name: tactic.name};
});
}

getArrayFormatted(arrayText) {
try {
const stringText = arrayText.toString();
const splitString = stringText.split(',');
const resultString = splitString.join(', ');
return resultString;
} catch (err) {
return arrayText;
}
formatTechniqueData (rawData) {
const { tactics, name, mitre_version } = rawData;
const tacticsObj = this.findTacticName(tactics)
this.setState({techniqueData: { name, mitre_version, tacticsObj }, loading: false });
}

renderHeader() {
Expand All @@ -180,7 +163,7 @@ export class FlyoutTechnique extends Component {
</EuiFlyoutHeader>
)
}

renderBody() {
const { currentTechnique } = this.props;
const { techniqueData } = this.state;
Expand All @@ -204,60 +187,45 @@ export class FlyoutTechnique extends Component {
title: 'ID',
description: ( <EuiToolTip
position="top"
content={"Open " + currentTechnique + " details in a new page"}>
<EuiLink href={link} external target="_blank">
content={"Open " + currentTechnique + " details in Intelligence section"}>
<EuiLink onClick={(e) => {this.props.openIntelligence(e,'techniques',currentTechnique);e.stopPropagation()}}>
{currentTechnique}
</EuiLink>
</EuiToolTip>)
},
{
title: 'Tactic',
description: this.getArrayFormatted(
techniqueData.phase_name
)
},
{
title: 'Platform',
description: this.getArrayFormatted(
techniqueData.platform_name
)
},
{
title: 'Data sources',
description: this.getArrayFormatted(
techniqueData.x_mitre_data_sources
)
title: 'Tactics',
description: techniqueData.tacticsObj
? techniqueData.tacticsObj.map((tactic) => {
return (
<>
<EuiToolTip
position="top"
content={
"Open " + tactic.name + " details in a Intelligence section"
}
>
<EuiLink
onClick={(e) => {
this.props.openIntelligence(e, "tactics", tactic.id);
e.stopPropagation();
}}
>
{tactic.name}
</EuiLink>
</EuiToolTip>
<br />
</>
);
})
: ""
},
{
title: 'Version',
description: techniqueData.version
},
{
title: 'Description',
description: formattedDescription
},
description: techniqueData.mitre_version
}

];
if(techniqueData && techniqueData.replaced_external_references && techniqueData.replaced_external_references.length > 0){
data.push({
title: 'References',
description: (
<EuiFlexGroup>
<EuiFlexItem>
{techniqueData.replaced_external_references.map((external_reference, external_reference_index) => (
<div key={`external_reference-${external_reference.index}`} id={`technique-reference-${external_reference.index}`}>
<span>{external_reference.index}. </span>
<EuiLink href={external_reference.url} target='_blank'>
{external_reference.source_name}
</EuiLink>
</div>
)
)}
</EuiFlexItem>
</EuiFlexGroup>
)
})
}
return (
<EuiFlyoutBody className="flyout-body" >
<EuiAccordion
Expand All @@ -279,13 +247,6 @@ export class FlyoutTechnique extends Component {
)) || (
<div style={{marginBottom: 30}}>
<EuiDescriptionList listItems={data} />
<EuiSpacer />
<p>
More info:{' '}
<EuiLink href={link} target="_blank">
{`MITRE ATT&CK - ${currentTechnique}`}
</EuiLink>
</p>
</div>
)}
</div>
Expand Down Expand Up @@ -320,7 +281,7 @@ export class FlyoutTechnique extends Component {
initialIsOpen={true}>
<EuiFlexGroup className="flyout-row">
<EuiFlexItem>
<Discover kbnSearchBar shareFilterManager={this.filterManager} initialColumns={["icon", "timestamp", 'rule.mitre.id', 'rule.mitre.tactic', 'rule.level', 'rule.id', 'rule.description']} implicitFilters={implicitFilters} initialFilters={[]} updateTotalHits={(total) => this.updateTotalHits(total)}/>
<Discover kbnSearchBar shareFilterManager={this.filterManager} initialColumns={["icon", "timestamp", 'rule.mitre.id', 'rule.mitre.tactic', 'rule.level', 'rule.id', 'rule.description']} implicitFilters={implicitFilters} initialFilters={[]} updateTotalHits={(total) => this.updateTotalHits(total)} openIntelligence={(e,redirectTo,itemId) => this.props.openIntelligence(e,redirectTo,itemId)}/>
</EuiFlexItem>
</EuiFlexGroup>
</EuiAccordion>
Expand Down

This file was deleted.

This file was deleted.

This file was deleted.

This file was deleted.