(data_sources_list, tactics_to_visualize, output_directory="generated_content")
download, parse and write content to csv.

    arguments:
        data_sources_list: string[] of datasource names. techniques_datasources.csv will be filtered according to this list
        tactics_to_visualize: string[] of tactic names. tsg_subset.csv will be filtered according to this list
        output_directory: string. The folder the output data will be written to. The folder will be created if it doesn't already exist.
download, parse and write content to csv.
download parse and write content to csv .
def generate_content(data_sources_list, tactics_to_visualize, output_directory="generated_content"):
    """download, parse and write content to csv.

    arguments:
        data_sources_list: string[] of datasource names. techniques_datasources.csv will be filtered according to this list
        tactics_to_visualize: string[] of tactic names. tsg_subset.csv will be filtered according to this list
        output_directory: string. The folder the output data will be written to. The folder will be created if it doesn't already exist.
    """

    # establish the connection to the TAXII server
    if verbose: print("establishing connection... ", end="", flush=True)
    tc_src = establish_connection("https://cti-taxii.mitre.org/stix/collections/95ecc380-afe9-11e4-9b6c-751b66dd541e/")
    if verbose: print("done!")

    # Get all techniques in Enterprise ATT&CK
    # use tqdm progress bar if verbose mode is enabled
    if verbose: pbar = tqdm(total=5, desc="retrieving data", bar_format="{desc} |{bar}| {percentage:3.0f}%  ", ncols=35)
    techniques = tc_src.query([Filter("type", "=", "attack-pattern")])
    if verbose: pbar.update(1)
    tools_set = tc_src.query([Filter("type", "=", "tool")])
    if verbose: pbar.update(1)
    malwares = tc_src.query([Filter("type", "=", "malware")])
    if verbose: pbar.update(1)
    intrusion_sets = tc_src.query([Filter("type", "=", "intrusion-set")])
    if verbose: pbar.update(1)
    relationships = tc_src.query([Filter("type", "=", "relationship")])
    if verbose: 
        pbar.update(1)
        print("") # tqdm needs a newline after the bar finishes

    # parse technique, software, and groups into helper dictionaries
    if verbose: print("parsing data... ", end="", flush=True)
    parse_techniques(techniques)
    parse_software(tools_set)
    parse_software(malwares)
    parse_groups(intrusion_sets)
    # parse relationships between techniques, software, and groups
    parse_relationships(relationships)
    # pars the tactics -> permissions counter
    parse_tactics()

    if verbose: 
        print("done!")
        print("writing output to directory " + output_directory + "... ", end="", flush=True)

    # write output files
    write_DPT(output_directory)
    write_tacticsToTechniques(output_directory)
    write_TSG(output_directory=output_directory)
    # tsg is too big for visualization, so write a subset version
    # select by tactics specified by user
    selected_techs=[]
    for tech in tech_to_tac:
        techniqueHasTactic = not set(tactics_to_visualize).isdisjoint(set(tech_to_tac[tech]))
        if techniqueHasTactic:
            selected_techs.append(tech)

    write_TSG(selected_techs, output_directory)
    # Write tactics -> permission file
    write_tacticPermissions(output_directory)
    # Write techniques + data sources
    write_techniquesToDatasources(data_sources_list, output_directory)
    if verbose: print("done!")
def generate_content ( data_sources_list , tactics_to_visualize , output_directory = "generated_content" ) : # establish the connection to the TAXII server if verbose : print ( "establishing connection... " , end = "" , flush = True ) tc_src = establish_connection ( "https://cti-taxii.mitre.org/stix/collections/95ecc380-afe9-11e4-9b6c-751b66dd541e/" ) if verbose : print ( "done!" ) # Get all techniques in Enterprise ATT&CK # use tqdm progress bar if verbose mode is enabled if verbose : pbar = tqdm ( total = 5 , desc = "retrieving data" , bar_format = "{desc} |{bar}| {percentage:3.0f}%  " , ncols = 35 ) techniques = tc_src . query ( [ Filter ( "type" , "=" , "attack-pattern" ) ] ) if verbose : pbar . update ( 1 ) tools_set = tc_src . query ( [ Filter ( "type" , "=" , "tool" ) ] ) if verbose : pbar . update ( 1 ) malwares = tc_src . query ( [ Filter ( "type" , "=" , "malware" ) ] ) if verbose : pbar . update ( 1 ) intrusion_sets = tc_src . query ( [ Filter ( "type" , "=" , "intrusion-set" ) ] ) if verbose : pbar . update ( 1 ) relationships = tc_src . query ( [ Filter ( "type" , "=" , "relationship" ) ] ) if verbose : pbar . update ( 1 ) print ( "" ) # tqdm needs a newline after the bar finishes # parse technique, software, and groups into helper dictionaries if verbose : print ( "parsing data... " , end = "" , flush = True ) parse_techniques ( techniques ) parse_software ( tools_set ) parse_software ( malwares ) parse_groups ( intrusion_sets ) # parse relationships between techniques, software, and groups parse_relationships ( relationships ) # pars the tactics -> permissions counter parse_tactics ( ) if verbose : print ( "done!" ) print ( "writing output to directory " + output_directory + "... " , end = "" , flush = True ) # write output files write_DPT ( output_directory ) write_tacticsToTechniques ( output_directory ) write_TSG ( output_directory = output_directory ) # tsg is too big for visualization, so write a subset version # select by tactics specified by user selected_techs = [ ] for tech in tech_to_tac : techniqueHasTactic = not set ( tactics_to_visualize ) . isdisjoint ( set ( tech_to_tac [ tech ] ) ) if techniqueHasTactic : selected_techs . append ( tech ) write_TSG ( selected_techs , output_directory ) # Write tactics -> permission file write_tacticPermissions ( output_directory ) # Write techniques + data sources write_techniquesToDatasources ( data_sources_list , output_directory ) if verbose : print ( "done!" )