Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature/change tactis and techniques resources #3346

Merged
Show file tree
Hide file tree
Changes from 20 commits
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
7 changes: 7 additions & 0 deletions CHANGELOG.md
Expand Up @@ -2,6 +2,12 @@

All notable changes to the Wazuh app project will be documented in this file.

## Wazuh v4.3.0 - Kibana 7.10.2 , 7.11.2 - Revision 4301

### Added

- Create the detail section for Mitre Intelligence resources. [#3344](https://github.com/wazuh/wazuh-kibana-app/pull/3344)

## Wazuh v4.2.0 - Kibana 7.10.2 , 7.11.2 - Revision 4201

### Added
Expand All @@ -23,6 +29,7 @@ All notable changes to the Wazuh app project will be documented in this file.
- Changed position of Top users on Integrity Monitoring Top 5 user. [#2892](https://github.com/wazuh/wazuh-kibana-app/pull/2892)
- Changed user allow_run_as way of editing. [#3080](https://github.com/wazuh/wazuh-kibana-app/pull/3080)
- Rename some ossec references to Wazuh [#3046](https://github.com/wazuh/wazuh-kibana-app/pull/3046)
- Changed tactis and techniques resources [#3346](https://github.com/wazuh/wazuh-kibana-app/pull/3346)

### Fixed

Expand Down
Expand Up @@ -56,6 +56,7 @@ export class FlyoutTechnique extends Component {
props!: {
currentTechniqueData: any
currentTechnique: string
tacticsObject: any
}

filterManager: FilterManager;
Expand Down Expand Up @@ -118,9 +119,9 @@ export class FlyoutTechnique extends Component {
try{
this.setState({loading: true, techniqueData: {}});
const { currentTechnique } = this.props;
const result = await WzRequest.apiReq('GET', '/mitre', {
const result = await WzRequest.apiReq('GET', '/mitre/techniques', {
params: {
q: `id=${currentTechnique}`
q: `references.external_id=${currentTechnique}`
}
});
const rawData = (((result || {}).data || {}).data || {}).affected_items
Expand All @@ -130,36 +131,20 @@ export class FlyoutTechnique extends Component {
}
}

formatTechniqueData (rawData) {
const { platform_name, phase_name} = rawData;
const { name, description, x_mitre_version: version, x_mitre_data_sources, external_references } = rawData.json;

const replaced_external_references = [];
let index_replaced_external_references = 0;
let last_citation_string = '';
const descriptionWithCitations = external_references.reduce((accum, reference) => {
return accum
.replace(new RegExp(`\\(Citation: ${reference.source_name}\\)`,'g'), (token) => {
if(last_citation_string !== token){
index_replaced_external_references++;
replaced_external_references.push({...reference, index: index_replaced_external_references});
last_citation_string = token;
}
return `<a style="vertical-align: super;" rel="noreferrer" class="euiLink euiLink--primary technique-reference-citation-${index_replaced_external_references}">[${String(index_replaced_external_references)}]</a>`;
})
}, description);
this.setState({techniqueData: { name, description: descriptionWithCitations, phase_name, platform_name, version, x_mitre_data_sources, external_references, replaced_external_references }, loading: false })
findTacticName(tactics){
const { tacticsObject } = this.props;
const getTactic = (element) => {
const tactic = Object.values(tacticsObject).find(obj => obj.id === element);
return { id:tactic.references[0].external_id, name: tactic.name};
};
return tactics.reduce((tacticsObj, element) => [...tacticsObj, getTactic(element)], []);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You could use .map instead of .reduce here.

}

getArrayFormatted(arrayText) {
try {
const stringText = arrayText.toString();
const splitString = stringText.split(',');
const resultString = splitString.join(', ');
return resultString;
} catch (err) {
return arrayText;
}
formatTechniqueData (rawData) {
const { tactics, name, mitre_version } = rawData;
const tacticsObj = this.findTacticName(tactics)

this.setState({techniqueData: { name, mitre_version, tacticsObj }, loading: false })
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semicolon

}

renderHeader() {
Expand All @@ -180,7 +165,7 @@ export class FlyoutTechnique extends Component {
</EuiFlyoutHeader>
)
}

renderBody() {
const { currentTechnique } = this.props;
const { techniqueData } = this.state;
Expand All @@ -204,60 +189,45 @@ export class FlyoutTechnique extends Component {
title: 'ID',
description: ( <EuiToolTip
position="top"
content={"Open " + currentTechnique + " details in a new page"}>
<EuiLink href={link} external target="_blank">
content={"Open " + currentTechnique + " details in Intelligence section"}>
<EuiLink onClick={(e) => {this.props.openIntelligence(e,'techniques',currentTechnique);e.stopPropagation()}}>
{currentTechnique}
</EuiLink>
</EuiToolTip>)
},
{
title: 'Tactic',
description: this.getArrayFormatted(
techniqueData.phase_name
)
},
{
title: 'Platform',
description: this.getArrayFormatted(
techniqueData.platform_name
)
},
{
title: 'Data sources',
description: this.getArrayFormatted(
techniqueData.x_mitre_data_sources
)
title: 'Tactics',
description: techniqueData.tacticsObj
? techniqueData.tacticsObj.map((tactic) => {
return (
<>
<EuiToolTip
position="top"
content={
"Open " + tactic.name + " details in a Intelligence section"
}
>
<EuiLink
onClick={(e) => {
this.props.openIntelligence(e, "tactics", tactic.id);
e.stopPropagation();
}}
>
{tactic.name}
</EuiLink>
</EuiToolTip>
<br />
</>
);
})
: ""
},
{
title: 'Version',
description: techniqueData.version
},
{
title: 'Description',
description: formattedDescription
},
description: techniqueData.mitre_version
}

];
if(techniqueData && techniqueData.replaced_external_references && techniqueData.replaced_external_references.length > 0){
data.push({
title: 'References',
description: (
<EuiFlexGroup>
<EuiFlexItem>
{techniqueData.replaced_external_references.map((external_reference, external_reference_index) => (
<div key={`external_reference-${external_reference.index}`} id={`technique-reference-${external_reference.index}`}>
<span>{external_reference.index}. </span>
<EuiLink href={external_reference.url} target='_blank'>
{external_reference.source_name}
</EuiLink>
</div>
)
)}
</EuiFlexItem>
</EuiFlexGroup>
)
})
}
return (
<EuiFlyoutBody className="flyout-body" >
<EuiAccordion
Expand All @@ -279,13 +249,6 @@ export class FlyoutTechnique extends Component {
)) || (
<div style={{marginBottom: 30}}>
<EuiDescriptionList listItems={data} />
<EuiSpacer />
<p>
More info:{' '}
<EuiLink href={link} target="_blank">
{`MITRE ATT&CK - ${currentTechnique}`}
</EuiLink>
</p>
</div>
)}
</div>
Expand Down

This file was deleted.

This file was deleted.

This file was deleted.

This file was deleted.