feat(data): adopt mitre-technique-map.json (refs #324)#413
Open
Daren9m wants to merge 1 commit into
Open
Conversation
Adopt M365-Assess's ATT&CK technique->tactic map as canonical CheckID data so mitre-attack findings can be grouped by tactic (technique IDs don't encode it). Adopted verbatim (100 entries) + CheckID schema + test. - data/mitre-technique-map.json ($schema added; map data unchanged) - data/mitre-technique-map.schema.json (technique-ID pattern + 14-tactic enum; values may be a single code or an array for future multi-tactic completeness) - tests/MitreTechniqueMap.Tests.ps1 (key format; tactic codes cross-checked against frameworks/mitre-attack.json scoring.tactics) - REFERENCES.md: canonical reference data row Coverage is partial by design of the source: the adopted map covers ~20% (96/477) of the technique IDs referenced by registry.json. Full ATT&CK coverage + a generator (scripts/Build-MitreTechniqueMap.py) remain to fully close #324. Refs #324
Daren9m
added this to the
v3.5.0 — Cross-Cutting Reconciliation & Canonical Data Layer milestone
Content enrichment populationOverall (1106 checks): rationale 26.4% (292/1106) • impact 26.4% (292/1106) • references 26.4% (292/1106)
Informational only — does not gate the build. The hard release-gate for Critical/High enrichment lives in #281 (v3.2.0). |
Framework mapping count delta
Result: ✓ PASS — no framework mapping regressions detected. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
data/frameworks/mitre-attack.jsondeclares the 14 ATT&CK tactics, but ATT&CK controlIds are technique IDs (T1078,T1078.001) that don't encode the tactic. A technique->tactic lookup is needed to group findings by tactic. Per #361's pattern, CheckID should own this canonically instead of each consumer reinventing it.What
Adopts M365-Assess's
controls/mitre-technique-map.jsonupstream:data/mitre-technique-map.json- 100 technique->tactic entries (data verbatim; only$schemaadded).data/mitre-technique-map.schema.json- draft 2020-12; technique-ID key pattern (T#### / T####.###), tactic-code enum (the 14 ATT&CK tactics), values allow a single code or an array (forward-compat with multi-tactic completeness).tests/MitreTechniqueMap.Tests.ps1- key format + every tactic code cross-checked againstframeworks/mitre-attack.jsonscoring.tactics.REFERENCES.md- canonical reference data row.Partial coverage (transparency)
The adopted map covers ~20% (96 / 477) of the technique IDs referenced by
registry.json. This matches the source: M365-Assess's copy was always partial. This PR establishes the canonical file + schema + contract; full ATT&CK-matrix coverage and the generator (scripts/Build-MitreTechniqueMap.py) remain to close #324.Testing
Notes
main;REFERENCES.mdadds a row to the Canonical Reference Data table - if a sibling adoption PR (e.g. feat(data): adopt canonical microsoft-first-party-appids.json (#361) #412) merges first, resolve the trivial table conflict by keeping both rows.Refs #324