Skip to content

Commit 59fba55

Browse files
mushinlogitj987987
mushinlogit
authored and
j987987
committed
Rc 0.3.6 (#963)
* Fix docker compose (#743) * fixed docker-compose.yml, api explorer is being built locally * updated compose * checked in compiled UI files temporarily, serving them through nginx * Fix docker compose (#744) * deleted old uifiles * updated uifiles * Issue 755 (#756) * Fix docker compose (#743) * fixed docker-compose.yml, api explorer is being built locally * updated compose * checked in compiled UI files temporarily, serving them through nginx * Fix docker compose (#744) * deleted old uifiles * updated uifiles * fixes #755, updated sensors observable data, updated observable data in config * fixes #762, mongo auth (#767) * consistent newlines across dev platforms (#769) * updated deploy * changed mongo auth steps to use host enviromental variables * changed mongo auth steps to use host enviromental variables * removed mongo pw support * Issue 738 (#774) * made Dockerfile for gateway image * added build docker hub script, removed ui files * fixes #738, updated docker compose to match new docker ignore rules * Issue 772 (#788) * jwt timeout config * updated jwtDurationSeconds * Adds test data for campaign, observable data, threat actors and sightings (#799) * updated readme * added missing data for campaigns, threat actors, sightings and observable data * Issue 812 (#821) * added rollup ID to sample assessments, changed name * updated created by ref for assessment samples * more reports from cert (#818) * more reports from cert * updated docker compose files to process reports * bump version 0.3.5 (#836) * updated discover gateway * updated public path for api explorer (#856) * add ntctf (#860) * use overriding docker containers to reduce replication (#863) * converted to docker version 3.3 * initial checking * The main docker compose and the development compose now works only if they are run as overriding * updated the deploy docker * dodcar sample capabilities (#879) * dodcar sample capabilities * case sensitive * better names for nginx config files (#873) * better dodcar test data * added debugging port and extra volumes for socket server debugging (#882) * Compose rework (#887) * converted to docker version 3.3 * initial checking * The main docker compose and the development compose now works only if they are run as overriding * updated the deploy docker * reorgnized the docker compose files and nginx config files. Rather than different conf files for every deployment, the main conf.d/default.conf has includes to deployment specific conf files, and those are loaded by docker-compose based on the type of deployment * Compose rework2 (#891) * better naming? * comments * not ready for ansible * Issue 889 (sample object assessments) (#897) * Added 2 sample object assessments (includes all NT CTF techniques) * Corrected object assessments * Renamed for consistency * Updated reference to Assessments 3.0 sample data file * Renamed * correct file * updated config groups (#893) * ntctf data for processor * Added 10 sightings quickly. Fixed #907 (#909) * Added 10 sightings quickly. Fixed #907 * moved the sightings to another file. * remove extra attack patterns for now * fix merge * removed some redundant sample stix, added auto publish STIX to processor (#916) * mongo logging flag (#917) * spelling * updated docker compose to use new processor args, added additional kill chains to config (#938) * Added created_by_ref for object assessments (#939) * updated build docker hub (#948) * Framework switch (#950) * framework switch * fix attack pattern ids * comment * add modified date (#954) * added initial-access to MITRE enterprise (#958) * assessment categories w/ ntctf attackpatterns (#957) * 0.3.6
1 parent 293a4d9 commit 59fba55

22 files changed

+10934
-600
lines changed

‎build-docker-hub.sh

+2-2
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,9 @@ if [ -d '../unfetter-ui' ]; then
3232
# Run docker compose
3333
cd ../unfetter;
3434
if [[ "$(uname -s)" == "Darwin" ]]; then
35-
docker-compose -f docker-compose.build-docker-hub.yml build;
35+
docker-compose -f docker-compose.yml -f docker-compose.build-docker-hub.yml build;
3636
else
37-
sudo docker-compose -f docker-compose.build-docker-hub.yml build;
37+
sudo docker-compose -f docker-compose.yml -f docker-compose.build-docker-hub.yml build;
3838
fi
3939
else
4040
echo "This script requires the unfetter-ui to be present as a sibling directory to unfetter.";

‎config/examples/unfetter-db/config.json

+115-35
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
1-
[{
1+
[
2+
{
23
"_id": "d9732cfc-166e-41a0-af79-d37e7abc69b2",
34
"configKey": "killChains",
4-
"configValue": [{
5+
"configValue": [
6+
{
57
"name": "mitre-attack",
68
"phase_names": [
79
"persistence",
@@ -13,44 +15,116 @@
1315
"execution",
1416
"collection",
1517
"exflitration",
16-
"command-and-control"
18+
"command-and-control",
19+
"initial-access"
1720
],
1821
"description": "Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK™) is a threat modeling methodology and suite of models for the various phases of an adversary's lifecycle and platforms that are known to be targeted by cyber threats. ATT&CK models are useful for understanding security risk against known adversary behavior, for planning security improvements, and verifying defenses work as expected.",
1922
"url": "https://attack.mitre.org/wiki/Main_Page"
2023
},
2124
{
22-
"name": "ctf",
25+
"name": "lockheed-martin",
2326
"phase_names": [
24-
"planning",
25-
"research",
26-
"develop-resources",
27-
"acquire-knowledge",
28-
"complete-preparation",
29-
"deployment",
30-
"interaction",
31-
"exploitation",
27+
"reconnaissance",
28+
"weaponization",
3229
"delivery",
33-
"control",
34-
"evasion",
35-
"expansion",
36-
"focus",
37-
"persistence",
38-
"enablement",
39-
"access-denial",
40-
"data-extraction",
41-
"data-alteration",
42-
"data-destruction"
30+
"exploitation",
31+
"installation",
32+
"command & control (c2)",
33+
"actions on objectives"
34+
],
35+
"description": "Lockheed Martin Cyber Threat Framework",
36+
"url": "https://www.lockheedmartin.com/us/what-we-do/aerospace-defense/cyber/cyber-kill-chain.html"
37+
},
38+
{
39+
"name": "ntctf",
40+
"phase_names": [
41+
"administer - planning",
42+
"administer - research development",
43+
"administer - research",
44+
"preparation - reconnaissance",
45+
"preparation - staging",
46+
"engagement - delivery",
47+
"engagement - exploitation",
48+
"presence - installation & execution",
49+
"presence - internal reconnaissance",
50+
"presence - privilege escalation",
51+
"presence - credential access",
52+
"presence - lateral movement",
53+
"presence - persistence",
54+
"effect - monitor",
55+
"effect - exflitration",
56+
"effect - modify",
57+
"effect - deny",
58+
"effect - destroy",
59+
"ongoing processes - analysis, evaluation, and feedback",
60+
"ongoing processes - command & control (c2)",
61+
"ongoing processes - evasion"
4362
],
4463
"stage_names": [
45-
"Preparation",
46-
"Engagement",
47-
"Presence",
48-
"Effect"
49-
]
64+
"administer",
65+
"preparation",
66+
"engagement",
67+
"presence",
68+
"effect",
69+
"ongoing processes"
70+
],
71+
"description": "NSA/CSS Technical Cyber Threat Framework v1",
72+
"url": "https://www.iad.gov/iad/library/reports/nsa-css-technical-cyber-threat-framework-v1.cfm"
73+
},
74+
{
75+
"name": "mitre-pre-attack",
76+
"phase_names": [
77+
"establish-&-maintain-infrastructure",
78+
"people-information-gathering",
79+
"technical-weakness-identification",
80+
"people-weakness-identification",
81+
"organizational-weakness-identification",
82+
"priority-definition-planning",
83+
"build-capabilities",
84+
"persona-development",
85+
"compromise",
86+
"organizational-information-gathering",
87+
"launch",
88+
"technical-information-gathering",
89+
"target-selection",
90+
"stage-capabilities",
91+
"adversary-opsec",
92+
"test-capabilities",
93+
"priority-definition-direction"
94+
],
95+
"description": "Building on ATT&CK™ —Adversarial Tactics, Techniques, and Common Knowledge— a MITRE-developed model to quickly identify and categorize behavior post-network infiltration, PRE-ATT&CK provides the ability to prevent an attack before the adversary has a chance to get in. The seventeen tactic categories for PRE-ATT&CK were derived from the first four stages (recon, weaponize, deliver, and execute) of a seven-stage Cyber Attack Lifecycle2 (first articulated by Lockheed Martin as the Cyber Kill Chain®3). This cyber threat framework captures the tactics, techniques, and procedures adversaries use to select a target, obtain information, and launch a campaign. The framework lists the ways that adversaries perform each tactic and provides the ability to track and organize adversary statistics and patterns. Ultimately, this arms defenders with a broader understanding of adversary actions that they can use to determine technical or policy-based mitigations and evaluate the quality and utility of cyber threat intelligence data sources.",
96+
"url": "https://attack.mitre.org/pre-attack/index.php/Main_Page"
97+
},
98+
{
99+
"name": "mitre-mobile-attack",
100+
"phase_names": [
101+
"collection",
102+
"command-and-control",
103+
"exfiltration",
104+
"defense-evasion",
105+
"discovery",
106+
"cellular-network-based",
107+
"general-network-based",
108+
"lateral-movement",
109+
"exploit-via-physical-access",
110+
"exploit-via-internet",
111+
"persistence",
112+
"credential-access",
113+
"app-delivery-via-authorized-app-store",
114+
"app-delivery-via-other-means",
115+
"effects",
116+
"supply-chain",
117+
"exploit-via-cellular-network",
118+
"cloud-based",
119+
"privilege-escalation"
120+
],
121+
"description": "The ATT&CK Mobile Profile builds upon NIST's Mobile Threat Catalogue, providing a model of adversarial tactics and techniques used to gain access to mobile devices as well as tactics and techniques to then take advantage of that access in order to accomplish adversarial objectives. The ATT&CK Mobile Profile also depicts network-based effects, which are adversarial tactics and techniques that an adversary can employ without access to the mobile device itself. Each adversarial technique includes a technical description along with applicable mitigation/countermeasure approaches, applicable detection analytics, and examples of use.",
122+
"url": "https://attack.mitre.org/mobile/index.php/Main_Page"
50123
}
51124
],
52125
"configGroups": [
53-
"stixConfig"
126+
"stixConfig",
127+
"public"
54128
]
55129
},
56130
{
@@ -228,14 +302,15 @@
228302
}
229303
},
230304
"configGroups": [
231-
"stixConfig"
305+
"stixConfig",
306+
"public"
232307
]
233-
234308
},
235309
{
236310
"_id": "98fba9e7-6ad8-4bac-a178-af9282f8b05c",
237311
"configKey": "observableDataTypes",
238-
"configValue": [{
312+
"configValue": [
313+
{
239314
"name": "driver",
240315
"actions": [
241316
"load",
@@ -405,7 +480,7 @@
405480
"ppid",
406481
"user"
407482
]
408-
},
483+
},
409484
{
410485
"name": "thread",
411486
"actions": [
@@ -457,13 +532,18 @@
457532
"user"
458533
]
459534
}
535+
],
536+
"configGroups": [
537+
"stixConfig",
538+
"public"
460539
]
461-
462-
463540
},
464541
{
465542
"_id": "905f4e32-528c-479a-bb20-aa36bb54be9f",
466543
"configKey": "jwtDurationSeconds",
467-
"configValue": 900
544+
"configValue": 900,
545+
"configGroups": [
546+
"public"
547+
]
468548
}
469549
]

0 commit comments

Comments
 (0)