You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Dec 11, 2023. It is now read-only.
This folder contains modules and scripts for working with ATT&CK layers. The core module allows users to load, validate, process, and save ATT&CK layers. A brief overview of the components can be found below. All scripts adhere to the MITRE ATT&CK Navigator Layer file format, [version 3.0](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv3.md).
3
+
This folder contains modules and scripts for working with ATT&CK Navigator layers. "ATT&CK Navigator Layers are a set of annotations overlayed on top of the ATT&CK Matrix. For more about ATT&CK Navigator layers, visit the ATT&CK Navigator repository. The core module allows users to load, validate, manipulate, and save ATT&CK layers. A brief overview of the components can be found below. All scripts adhere to the MITRE ATT&CK Navigator Layer file format, [version 3.0](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv3.md).
4
4
5
+
#### Core Modules
5
6
| script | description |
6
7
|:-------|:------------|
7
-
|[exceptions.py](core/exceptions.py)| Implements errors and supporting functions for the core module. |
8
-
|[filter.py](core/filter.py)| Implements a basic filter object. |
9
-
|[gradient.py](core/gradient.py)| Implements a basic gradient object. |
10
-
|[layer.py](core/layer.py)| Provides an interface for interacting with core module's layer representation. A further breakdown can be found in the corresponding section below. |
11
-
|[layerobj.py](core/layerobj.py)| Implements a basic layer object. This should not be manipulated directly, instead, use the [layer representation](core/layer.py). |
12
-
|[layout.py](core/layout.py)| Implements a basic layout object. |
13
-
|[legenditem.py](core/legenditem.py)| Implements a basic legenditem object. |
14
-
|[metadata.py](core/metadata.py)| Implements a basic metadata object. |
15
-
|[technique.py](core/technique.py)| Implements a basic technique object. |
16
-
|[layerops.py](manipulators/layerops.py)| Provides a means by which to combine multiple ATT&CK layer objects in customized ways. A further breakdown can be found in the corresponding section below. |
17
-
18
-
## layer.py
19
-
Layer.py provides a Layer class, which is the interface used to interact with the rest of the core module, and provides an abstract representation of an ATT&CK layer. The layer class has a collection of methods, the functionality of which is documented in the table below. An example of how to interface with the class to load and retrieve layer objects is documented following that.
20
-
21
-
| method | description |
8
+
|[filter](core/filter.py)| Implements a basic [filter object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv3.md#filter-object-properties). |
9
+
|[gradient](core/gradient.py)| Implements a basic [gradient object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv3.md#gradient-object-properties). |
10
+
|[layer](core/layer.py)| Provides an interface for interacting with core module's layer representation. A further breakdown can be found in the corresponding section below. |
11
+
|[layout](core/layout.py)| Implements a basic [layout object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv3.md#layout-object-properties). |
12
+
|[legenditem](core/legenditem.py)| Implements a basic [legenditem object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv3.md#legenditem-object-properties). |
13
+
|[metadata](core/metadata.py)| Implements a basic [metadata object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv3.md#metadata-object-properties). |
14
+
|[technique](core/technique.py)| Implements a basic [technique object](https://github.com/mitre-attack/attack-navigator/blob/develop/layers/LAYERFORMATv3.md#technique-object-properties). |
15
+
16
+
#### Manipulator Scripts
17
+
| script | description |
18
+
|:-------|:------------|
19
+
|[layerops](manipulators/layerops.py)| Provides a means by which to combine multiple ATT&CK layer objects in customized ways. A further breakdown can be found in the corresponding section below. |
20
+
21
+
## Layer
22
+
The Layer class provides format validation and read/write capabilities to aid in working with ATT&CK Navigator Layers in python. It is the primary interface through which other Layer-related classes defined in the core module should be used. The Layer class API and a usage example are below.
23
+
24
+
| method [x = Layer()]| description |
22
25
|:-------|:------------|
23
-
|Layer().load_input(_input_) | Loads an ATT&CK layer from either a dictionary or a string representation of a dictionary. |
24
-
|Layer().load_file(_input_) | Loads an ATT&CK layer from a file location specified by the _input_. |
25
-
|Layer().export_file(_input_) | Saves the current state of the loaded ATT&CK layer to a json file denoted by the _input_. |
26
-
|Layer().get_dict() | Returns a representation of the current ATT&CK layer object as a dictionary. |
26
+
|x.load_input(_input_) | Loads an ATT&CK layer from either a dictionary or a string representation of a dictionary. |
27
+
|x.load_file(_input_) | Loads an ATT&CK layer from a file location specified by the _input_. |
28
+
|x.export_file(_input_) | Saves the current state of the loaded ATT&CK layer to a json file denoted by the _input_. |
29
+
|x.get_dict() | Returns a representation of the current ATT&CK layer object as a dictionary. |
layer1 = Layer(example_layer_dict)# Create a new layer and load existing data
46
+
layer1.export_file(example_layer_out_location)# Write out the loaded layer to the specified file
45
47
46
-
layer2 = Layer()
47
-
layer2.load_input(example_layer_dict)
48
-
layer2.get_dict()
48
+
layer2 = Layer()# Create a new layer object
49
+
layer2.load_input(example_layer_dict)# Load layer data into existing layer object
50
+
print(layer2.get_dict()) # Retrieve the loaded layer's data as a dictionary, and print it
49
51
50
-
layer3 = Layer()
51
-
layer3.load_file(example_layer_location)
52
+
layer3 = Layer()# Create a new layer object
53
+
layer3.load_file(example_layer_location)# Load layer data from a file into existing layer object
52
54
```
53
55
54
56
## layerops.py
55
57
Layerops.py provides the LayerOps class, which is a way to combine layer files in an automated way, using user defined lambda functions. Each LayerOps instance, when created, ingests the provided lambda functions, and stores them for use. An existing LayerOps class can be used to combine layer files according to the initialized lambda using the process method. The breakdown of this two step process is documented in the table below, while examples of both the list and dictionary modes of operation can be found below.
56
58
57
-
| method | description |
58
-
|:-------|:------------|
59
-
| LayerOps(score=_score_, comment=_comment_, enabled=_enabled_, colors=_colors_, metadata=_metadata_, name=_name_, desc=_desc_, default_values=_default_values_) | Each of the _inputs_ takes a lambda function that will be used to combine technique object fields matching the parameter. The one exception to this is _default_values_, which is an optional dictionary argument containing default values to provide the lambda functions if elements of the combined layers are missing them. |
60
-
| LayerOps.process(_data_, defaults=_defaults_) | Applies the lambda functions stored during initialization to the layer objects in _data_. _data_ must be either a list or a dictionary of Layer objects, and is expected to match the format of the lambda equations provided during initialization. |
59
+
##### LayerOps()
60
+
```python
61
+
x = LayerOps(score=score, comment=comment, enabled=enabled, colors=colors, metadata=metadata, name=name, desc=desc, default_values=default_values)
62
+
```
63
+
64
+
Each of the _inputs_ takes a lambda function that will be used to combine technique object fields matching the parameter. The one exception to this is _default_values_, which is an optional dictionary argument containing default values to provide the lambda functions if techniques of the combined layers are missing them.
65
+
66
+
##### .process() Method
67
+
```python
68
+
x.process(data, defaults=defaults)
69
+
```
70
+
The process method applies the lambda functions stored during initialization to the layer objects in _data_. _data_ must be either a list or a dictionary of Layer objects, and is expected to match the format of the lambda equations provided during initialization.
61
71
62
72
#### Example Usage
63
73
```python
@@ -67,19 +77,42 @@ from layers.core.layer import Layer
0 commit comments