Assessor_2.0/docs/MITRE_CATALOG.md

Enterprise ATT&CK catalog in ASSESSOR

Pathfinder uses the compact, versioned default catalog at src/assets/data/mitre-enterprise-v19.2.json. It was generated from MITRE's official Enterprise ATT&CK STIX 2.1 bundle:

• Source: https://github.com/mitre-attack/attack-stix-data/blob/master/enterprise-attack/enterprise-attack-19.2.json
• Source SHA-256: DC1639CAA5501D720E280CF1CBD8FBE009884A0C9B3E6E9ED9D0C25166C3D8F4
• Collection version: 19.2; 15 active tactics, 697 active techniques and subtechniques, 1,057 active groups, campaigns and software entries.

To refresh the repo asset, download a version-pinned official Enterprise STIX bundle and run node --experimental-strip-types scripts/update-mitre-asset.mts <path-to-bundle>. Review the generated version, counts and graph tests before changing the default import. The converter follows the STIX matrix tactic order and omits revoked or deprecated objects and relationships.

The Data Hub has three actions:

• Update from MITRE fetches the official latest Enterprise STIX bundle from MITRE's attack-stix-data repository, validates and converts it, and activates it only when its collection version is newer than the active shared catalog. The compact result is saved atomically at <ASSESSOR_ARTIFACT_ROOT>/reference-data/mitre-enterprise.json, outside the public web root. The backend serves that catalog after restart, and Pathfinder receives an immediate update event in the current browser. The browser's custom override is cleared after a successful update check.
• Download from MITRE fetches the original latest Enterprise STIX JSON from that same MITRE source and offers it as enterprise-attack-v<version>.json. Downloading does not activate or persist it. The backend proxy keeps the browser same-origin and validates the source before sending it. The source is capped at 80 MiB and the request times out after 120 seconds.
• Import JSON file is the manual fallback. It accepts an official Enterprise STIX bundle or the compact ASSESSOR JSON format. A custom matrix is stored in browser localStorage, overrides the shared catalog only in that browser, and is shown as Custom v<version>. Use active catalog removes this override. The open Pathfinder graph updates after either action.

The shared catalog is read through GET /api/v1/reference-data/mitre-attack; the guarded POST /api/v1/reference-data/mitre-attack/refresh updates it, and GET /api/v1/reference-data/mitre-attack/source sends the latest validated original file. No PostgreSQL schema or existing assessment data is changed. MITRE availability is required for update and download; the bundled v19.2 catalog and manual import remain available offline. A shared catalog update does not remove another browser's deliberate local override.

Reference recognition (2.8.0)

ATT&CK updates now also retain the complete versioned recognition catalog, including historical entries, alongside the active graph in the same atomic file. Stored scanner reference runs remain frozen until the explicit client action Recognize references. The bundled D3FEND catalog and reference storage are documented in docs/REFERENCE_RECOGNITION.md. Migration 023 adds this independent derived storage; the update/download buttons themselves do not rewrite assessment data. Manual browser matrix overrides remain graph fallbacks and do not select backend recognition catalogs.