28 lines
3.4 KiB
Markdown
28 lines
3.4 KiB
Markdown
# Enterprise ATT&CK catalog in ASSESSOR
|
|
|
|
Pathfinder uses the compact, versioned default catalog at `src/assets/data/mitre-enterprise-v19.2.json`. It was generated from MITRE's official Enterprise ATT&CK STIX 2.1 bundle:
|
|
|
|
- Source: https://github.com/mitre-attack/attack-stix-data/blob/master/enterprise-attack/enterprise-attack-19.2.json
|
|
- Source SHA-256: `DC1639CAA5501D720E280CF1CBD8FBE009884A0C9B3E6E9ED9D0C25166C3D8F4`
|
|
- Collection version: 19.2; 15 active tactics, 697 active techniques and subtechniques, 1,057 active groups, campaigns and software entries.
|
|
|
|
To refresh the repo asset, download a **version-pinned** official Enterprise STIX bundle and run `node --experimental-strip-types scripts/update-mitre-asset.mts <path-to-bundle>`. Review the generated version, counts and graph tests before changing the default import. The converter follows the STIX matrix tactic order and omits revoked or deprecated objects and relationships.
|
|
|
|
The Data Hub has three actions:
|
|
|
|
- **Update from MITRE** fetches the official latest Enterprise STIX bundle from MITRE's `attack-stix-data` repository, validates and converts it, and activates it only when its collection version is newer than the active shared catalog. The compact result is saved atomically at `<ASSESSOR_ARTIFACT_ROOT>/reference-data/mitre-enterprise.json`, outside the public web root. The backend serves that catalog after restart, and Pathfinder receives an immediate update event in the current browser. The browser's custom override is cleared after a successful update check.
|
|
- **Download from MITRE** fetches the original latest Enterprise STIX JSON from that same MITRE source and offers it as `enterprise-attack-v<version>.json`. Downloading does not activate or persist it. The backend proxy keeps the browser same-origin and validates the source before sending it. The source is capped at 80 MiB and the request times out after 120 seconds.
|
|
- **Import JSON file** is the manual fallback. It accepts an official Enterprise STIX bundle or the compact ASSESSOR JSON format. A custom matrix is stored in browser `localStorage`, overrides the shared catalog only in that browser, and is shown as `Custom v<version>`. **Use active catalog** removes this override. The open Pathfinder graph updates after either action.
|
|
|
|
The shared catalog is read through `GET /api/v1/reference-data/mitre-attack`; the guarded `POST /api/v1/reference-data/mitre-attack/refresh` updates it, and `GET /api/v1/reference-data/mitre-attack/source` sends the latest validated original file. No PostgreSQL schema or existing assessment data is changed. MITRE availability is required for update and download; the bundled v19.2 catalog and manual import remain available offline. A shared catalog update does not remove another browser's deliberate local override.
|
|
|
|
## Reference recognition (2.8.0)
|
|
|
|
ATT&CK updates now also retain the complete versioned recognition catalog, including
|
|
historical entries, alongside the active graph in the same atomic file. Stored scanner
|
|
reference runs remain frozen until the explicit client action **Recognize references**.
|
|
The bundled D3FEND catalog and reference storage are documented in
|
|
`docs/REFERENCE_RECOGNITION.md`. Migration 023 adds this independent derived storage;
|
|
the update/download buttons themselves do not rewrite assessment data. Manual browser
|
|
matrix overrides remain graph fallbacks and do not select backend recognition catalogs.
|