(ds, fieldnames, relationship_type, type_filter, source_name, sorting_keys, tactic=None)
return sorted(writable_results, key=lambda x: (x[sorting_keys[0]], x[sorting_keys[1]]))
Main logic to map techniques to mitigations, groups or software
Main logic to map techniques to mitigations, groups or software
Main logic to map techniques to mitigations groups or software
def do_mapping(ds, fieldnames, relationship_type, type_filter, source_name, sorting_keys, tactic=None):
    """Main logic to map techniques to mitigations, groups or software"""
    all_attack_patterns = get_all_techniques(ds, source_name, tactic)
    writable_results = []

    for attack_pattern in tqdm.tqdm(all_attack_patterns, desc="parsing data for techniques"):
        # Grabs relationships for identified techniques
        relationships = filter_for_term_relationships(ds, relationship_type, attack_pattern.id)

        for relationship in relationships:
            # Groups are defined in STIX as intrusion-set objects
            # Mitigations are defined in STIX as course-of-action objects
            # Software are defined in STIX as malware objects
            stix_results = filter_by_type_and_id(ds, type_filter, relationship.source_ref, source_name)

            if stix_results:
                row_data = (
                    grab_external_id(attack_pattern, source_name),
                    attack_pattern.name,
                    grab_external_id(stix_results[0], source_name),
                    stix_results[0].name,
                    escape_chars(stix_results[0].description),
                    escape_chars(relationship.description),
                )

                writable_results.append(dict(zip(fieldnames, row_data)))

    return sorted(writable_results, key=lambda x: (x[sorting_keys[0]], x[sorting_keys[1]]))
def do_mapping ( ds , fieldnames , relationship_type , type_filter , source_name , sorting_keys , tactic = None ) : all_attack_patterns = get_all_techniques ( ds , source_name , tactic ) writable_results = [ ] for attack_pattern in tqdm . tqdm ( all_attack_patterns , desc = "parsing data for techniques" ) : # Grabs relationships for identified techniques relationships = filter_for_term_relationships ( ds , relationship_type , attack_pattern . id ) for relationship in relationships : # Groups are defined in STIX as intrusion-set objects # Mitigations are defined in STIX as course-of-action objects # Software are defined in STIX as malware objects stix_results = filter_by_type_and_id ( ds , type_filter , relationship . source_ref , source_name ) if stix_results : row_data = ( grab_external_id ( attack_pattern , source_name ) , attack_pattern . name , grab_external_id ( stix_results [ 0 ] , source_name ) , stix_results [ 0 ] . name , escape_chars ( stix_results [ 0 ] . description ) , escape_chars ( relationship . description ) , ) writable_results . append ( dict ( zip ( fieldnames , row_data ) ) ) return sorted ( writable_results , key = lambda x : ( x [ sorting_keys [ 0 ] ] , x [ sorting_keys [ 1 ] ] ) )