You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Dec 11, 2023. It is now read-only.
Copy file name to clipboardExpand all lines: layers/README.md
+33-32Lines changed: 33 additions & 32 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,18 +1,18 @@
1
1
# layers
2
2
3
-
This folder contains modules and scripts for working with ATT&CK Navigator layers. ATT&CK Navigator Layers are a set of annotations overlayed on top of the ATT&CK Matrix. For more about ATT&CK Navigator layers, visit the ATT&CK Navigator repository. The core module allows users to load, validate, manipulate, and save ATT&CK layers. A brief overview of the components can be found below. All scripts adhere to the MITRE ATT&CK Navigator Layer file format, [version 4.0](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4.md), but will accept legacy [version 3.0](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv3.md) layers, upgrading them to version 4.
3
+
This folder contains modules and scripts for working with ATT&CK Navigator layers. ATT&CK Navigator Layers are a set of annotations overlayed on top of the ATT&CK Matrix. For more about ATT&CK Navigator layers, visit the ATT&CK Navigator repository. The core module allows users to load, validate, manipulate, and save ATT&CK layers. A brief overview of the components can be found below. All scripts adhere to the MITRE ATT&CK Navigator Layer file format, [version 4.1](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4_1.md), but will accept legacy [version 3.0](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv3.md) layers, upgrading them to version 4.1.
4
4
5
5
#### Core Modules
6
6
| script | description |
7
7
|:-------|:------------|
8
-
|[filter](core/filter.py)| Implements a basic [filter object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4.md#filter-object-properties). |
9
-
|[gradient](core/gradient.py)| Implements a basic [gradient object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4.md#gradient-object-properties). |
8
+
|[filter](core/filter.py)| Implements a basic [filter object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4_1.md#filter-object-properties). |
9
+
|[gradient](core/gradient.py)| Implements a basic [gradient object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4_1.md#gradient-object-properties). |
10
10
|[layer](core/layer.py)| Provides an interface for interacting with core module's layer representation. A further breakdown can be found in the corresponding [section](#Layer) below. |
11
-
|[layout](core/layout.py)| Implements a basic [layout object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4.md#layout-object-properties). |
12
-
|[legenditem](core/legenditem.py)| Implements a basic [legenditem object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4.md#legenditem-object-properties). |
13
-
|[metadata](core/metadata.py)| Implements a basic [metadata object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4.md#metadata-object-properties). |
14
-
|[technique](core/technique.py)| Implements a basic [technique object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4.md#technique-object-properties). |
15
-
|[versions](core/versions.py)| Impelments a basic [versions object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4.md#versions-object-properties).|
11
+
|[layout](core/layout.py)| Implements a basic [layout object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4_1.md#layout-object-properties). |
12
+
|[legenditem](core/legenditem.py)| Implements a basic [legenditem object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4_1.md#legenditem-object-properties). |
13
+
|[metadata](core/metadata.py)| Implements a basic [metadata object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4_1.md#metadata-object-properties). |
14
+
|[technique](core/technique.py)| Implements a basic [technique object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4_1.md#technique-object-properties). |
15
+
|[versions](core/versions.py)| Impelments a basic [versions object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv4_1.md#versions-object-properties).|
16
16
#### Manipulator Scripts
17
17
| script | description |
18
18
|:-------|:------------|
@@ -22,14 +22,14 @@ This folder contains modules and scripts for working with ATT&CK Navigator layer
22
22
| script | description |
23
23
|:-------|:------------|
24
24
|[to_excel](exporters/to_excel.py)| Provides a means by which to export an ATT&CK Layer to an excel file. A further breakdown can be found in the corresponding [section](#to_excel.py) below. |
25
-
|[to_svg](exporters/to_svg.py)| Provides a means by which to export an ATT&CK layer to an svg image file. A further breakdown can be found in the corresponding [section](#to_svg.py) below. This file also contains the `SVGConfig` object that can be used to configure the SVG export.|
25
+
|[to_svg](exporters/to_svg.py)| Provides a means by which to export an ATT&CK layer to an svg image file. A further breakdown can be found in the corresponding [section](#to_svg.py) below. This file also contains the `SVGConfig` object that can be used to configure the SVG export.|
26
26
##### Utility Modules
27
27
| script | description |
28
28
|:-------|:------------|
29
29
|[excel_templates](exporters/excel_templates.py)| Provides a means by which to convert a matrix into a clean excel matrix template. |
30
30
|[matrix_gen](exporters/matrix_gen.py)| Provides a means by which to generate a matrix from raw data, either from the ATT&CK TAXII server or from a local STIX Bundle. |
31
31
|[svg_templates](exporters/svg_templates.py)| Provides a means by which to convert a layer file into a marked up svg file. |
32
-
|[svg_objects](exporters/svg_objects.py)| Provides raw templates and supporting functionality for generating svg objects. |
32
+
|[svg_objects](exporters/svg_objects.py)| Provides raw templates and supporting functionality for generating svg objects. |
33
33
##### Command Line Tools
34
34
| script | description |
35
35
|:-------|:------------|
@@ -45,7 +45,7 @@ The Layer class provides format validation and read/write capabilities to aid in
45
45
| x.from_file(_filepath_) | Loads an ATT&CK layer from a file location specified by the _filepath_. |
46
46
| x.to_file(_filepath_) | Saves the current state of the loaded ATT&CK layer to a json file denoted by the _filepath_. |
47
47
| x.to_dict() | Returns a representation of the current ATT&CK layer object as a dictionary. |
48
-
| x.to_str() | Returns a representation of the current ATT&CK layer object as a string representation of a dictionary. |
48
+
| x.to_str() | Returns a representation of the current ATT&CK layer object as a string representation of a dictionary. |
49
49
50
50
#### Example Usage
51
51
@@ -88,7 +88,7 @@ Layerops.py provides the LayerOps class, which is a way to combine layer files i
88
88
```python
89
89
x = LayerOps(score=score, comment=comment, enabled=enabled, colors=colors, metadata=metadata, name=name, desc=desc, default_values=default_values)
90
90
```
91
-
91
+
92
92
Each of the _inputs_ takes a lambda function that will be used to combine technique object fields matching the parameter. The one exception to this is _default_values_, which is an optional dictionary argument containing default values to provide the lambda functions if techniques of the combined layers are missing them.
# Example 1) Build a LayerOps object that takes a list and averages scores across the layers
114
-
lo = LayerOps(score=lambdax: sum(x) /len(x),
115
-
name=lambdax: x[1],
114
+
lo = LayerOps(score=lambdax: sum(x) /len(x),
115
+
name=lambdax: x[1],
116
116
desc=lambdax: "This is an list example") # Build LayerOps object
117
117
out_layer = lo.process([demo, demo2]) # Trigger processing on a list of demo and demo2 layers
118
118
out_layer.to_file("C:\demo_layer1.json") # Save averaged layer to file
119
119
out_layer2 = lo.process([demo, demo2, demo3]) # Trigger processing on a list of demo, demo2, demo3
120
120
visual_aid = out_layer2.to_dict() # Retrieve dictionary representation of processed layer
121
121
122
122
# Example 2) Build a LayerOps object that takes a dictionary and averages scores across the layers
123
-
lo2 = LayerOps(score=lambdax: sum([x[y] for y in x]) /len([x[y] for y in x]),
124
-
color=lambdax: x['b'],
123
+
lo2 = LayerOps(score=lambdax: sum([x[y] for y in x]) /len([x[y] for y in x]),
124
+
color=lambdax: x['b'],
125
125
desc=lambdax: "This is a dict example") # Build LayerOps object, with lambda
126
126
out_layer3 = lo2.process({'a': demo, 'b': demo2}) # Trigger processing on a dictionary of demo and demo2
127
127
dict_layer = out_layer3.to_dict() # Retrieve dictionary representation of processed layer
@@ -147,23 +147,23 @@ out_layer6.to_file("C:\demo_layer6.json") # Save combined co
147
147
```
148
148
149
149
## to_excel.py
150
-
to_excel.py provides the ToExcel class, which is a way to export an existing layer file as an Excel
151
-
spreadsheet. The ToExcel class has an optional parameter for the initialization function, that
152
-
tells the exporter what data source to use when building the output matrix. Valid options include using live data from cti-taxii.mitre.org or using a local STIX bundle.
150
+
to_excel.py provides the ToExcel class, which is a way to export an existing layer file as an Excel
151
+
spreadsheet. The ToExcel class has an optional parameter for the initialization function, that
152
+
tells the exporter what data source to use when building the output matrix. Valid options include using live data from cti-taxii.mitre.org or using a local STIX bundle.
153
153
154
154
##### ToExcel()
155
155
```python
156
156
x = ToExcel(domain='enterprise', source='taxii', local=None)
157
157
```
158
-
The ToExcel constructor takes domain, server, and local arguments during instantiation. The domain can
158
+
The ToExcel constructor takes domain, server, and local arguments during instantiation. The domain can
159
159
be either `enterprise` or `mobile`, and can be pulled directly from a layer file as `layer.domain`. The source argument tells the matrix generation tool which data source to use when building the matrix. `taxii` indicates that the tool should utilize the official ATT&CK Taxii Server (`cti-taxii`) when building the matrix, while the `local` option indicates that it should use a local bundle respectively. The local argument is only required if the source is set to `local`, in which case it should be a path to a local stix bundle.
160
160
161
161
##### .to_xlsx() Method
162
162
```python
163
163
x.to_xlsx(layer=layer, filepath="layer.xlsx")
164
164
```
165
-
The to_xlsx method exports the layer file referenced as `layer`, as an excel file to the
166
-
`filepath` specified.
165
+
The to_xlsx method exports the layer file referenced as `layer`, as an excel file to the
to_svg.py provides the ToSvg class, which is a way to export an existing layer file as an SVG image file. The ToSvg class, like the ToExcel class, has an optional parameter for the initialization function, that
185
-
tells the exporter what data source to use when building the output matrix. Valid options include using live data from cti-taxii.mitre.org or using a local STIX bundle.
184
+
to_svg.py provides the ToSvg class, which is a way to export an existing layer file as an SVG image file. The ToSvg class, like the ToExcel class, has an optional parameter for the initialization function, that
185
+
tells the exporter what data source to use when building the output matrix. Valid options include using live data from cti-taxii.mitre.org or using a local STIX bundle.
186
186
187
187
##### ToSvg()
188
188
```python
@@ -195,7 +195,7 @@ The ToSvg constructor, just like the ToExcel constructor, takes domain, server,
195
195
y = SVGConfig(width=8.5, height=11, headerHeight=1, unit="in", showSubtechniques="expanded",
The SVGConfig object is used to configure how an SVG export behaves. The defaults for each of the available values can be found in the declaration above, and a brief explanation for each field is included in the table below. The config object should be provided to the ToSvg object during instantiation, but if values need to be updated on the fly, the currently loaded configuration can be interacted with at `ToSvg().config`. The configuration can also be populated from a json file using the `.load_from_file(filename="path/to/file.json")` method, or stored to one using the `.save_to_file(filename="path/to/file.json)` method.
201
201
@@ -204,10 +204,10 @@ The SVGConfig object is used to configure how an SVG export behaves. The default
0 commit comments