Skip to content

Commit

Permalink
Ensure the tactic is visbile in the MITRE ATT&CK suggestion button na…
Browse files Browse the repository at this point in the history
…me, as techniques can apply to mutliple tactics.

Only parse .yar files as yara files (in case we want to add a README.md file to the dir, for example)
  • Loading branch information
neonbunny committed Nov 22, 2024
1 parent 7d0badd commit e2a367b
Show file tree
Hide file tree
Showing 2 changed files with 9 additions and 7 deletions.
10 changes: 6 additions & 4 deletions event_tracker/mitre_attack_suggester/yara_suggester.py
Original file line number Diff line number Diff line change
Expand Up @@ -17,10 +17,12 @@ def watch_yara_files(sender, *args, **kwargs):
compiler = yara_x.Compiler(relaxed_re_syntax=True)

# Iterate over files in directory
for name in os.listdir(directory):
# Open file
with open(os.path.join(directory, name)) as f:
compiler.add_source(f.read(), os.path.join(directory, name))
with os.scandir(directory) as entries:
for entry in entries:
if entry.name.endswith('.yar') and entry.is_file():
with open(os.path.join(directory, entry.name)) as f:
compiler.add_source(f.read(), entry.path)


rules = compiler.build()

Expand Down
6 changes: 3 additions & 3 deletions event_tracker/templates/suggestions/mitre_attack.html
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,11 @@
{% for suggestion in mitre_suggestions %}
<a class="btn btn-secondary btn-sm mitre-attack-suggestion d-inline-block my-1" href="#" data-tactic="{{ suggestion.mitre_attack_tactic.pk }}" {% if suggestion.mitre_attack_technique %}data-technique="{{ suggestion.mitre_attack_technique.pk }}"{% endif %} {% if suggestion.mitre_attack_subtechnique %}data-subtechnique="{{ suggestion.mitre_attack_subtechnique.pk }}"{% endif %}>
{% if suggestion.mitre_attack_subtechnique %}
{{ suggestion.mitre_attack_subtechnique.mitre_id }} {{ suggestion.mitre_attack_technique.name }} - {{ suggestion.mitre_attack_subtechnique.name }}
{{ suggestion.mitre_attack_tactic.name }} &ndash; {{ suggestion.mitre_attack_subtechnique.name }}
{% elif suggestion.mitre_attack_technique %}
{{ suggestion.mitre_attack_technique }}
{{ suggestion.mitre_attack_tactic.name }} &ndash; {{ suggestion.mitre_attack_technique.name }}
{% elif suggestion.mitre_attack_tactic %}
{{ suggestion.mitre_attack_tactic }}
{{ suggestion.mitre_attack_tactic.name }}
{% else %}
-
{% endif %}
Expand Down

0 comments on commit e2a367b

Please sign in to comment.