💡 [REQUEST] Ability to Filter on MITRE ATT&CK Metadata

[d3sch41n]

Implementation PR

No response

Reference Issues

No response

Summary

The ttpforge list ttps command should have the ability to filter on the MITRE tactics/techniques/subtechniques fields

Basic Example

Intended operation should implement "list all TTPs from these MITRE tactics" as follows:

ttpforge list ttps --mitre-tactics="TA0042,TA0003" 

An error should be thrown if higher-specificity options are mixed with lower specificity ones, because it's ambiguous what that should mean (intersection or union) - intersection will give weird empty results too frequently due to non-overlapping filters, and union is better achieved by just running the command twice. Hence, this should error:

ttpforge list ttps --mitre-tactics="TA0042" --mitre-techniques="T1098" 

Drawbacks

maintaining a search index might take more work than anticipated

Unresolved questions

No response

Associated Issues

#196

[d3sch41n]

Note: No guarantees that this will be implemented in a fancy way - for example, I might just symlink a MITRE catalog directory structure on top of our existing Armory TTPs directory structure. Whatever gets the job done.

However, I'm thinking I'll probably have this command:

ttpforge search build-index 

That will walk all the repos and update the index - this command will need to be re-run when you change any TTPs. We can ship the index files in the armory repo, like how ART does it

[l50]

Note: No guarantees that this will be implemented in a fancy way - for example, I might just symlink a MITRE catalog directory structure on top of our existing Armory TTPs directory structure. Whatever gets the job done.

However, I'm thinking I'll probably have this command:

ttpforge search build-index 

That will walk all the repos and update the index - this command will need to be re-run when you change any TTPs. We can ship the index files in the armory repo, like how ART does it

This could work, although we'd probably want to use a go routine to run on a regular basis in the background or based on changes in the target repo (could do like a git diff or track the commit hash and compare it)