Seeing some strangeness about dettect

[rubinatorz]

hi @etheruler

MITRE's TAXII server is down for already a couple of days... I can't help that.

To fix this for now, and also in the future and also to make your runs run faster: you can use the --local-stix-path command line parameter. You can clone the CTI STIX repository (https://github.com/mitre/cti) and use it in DeTT&CT as offline ATT&CK source instead of the TAXII server.

The DeTT&CT code base of January 25 uses the same TAXII server... but probably it's working because of cached data. DeTT&CT caches information from TAXII server in the cache folder, so maybe your January 25 version still has a filled cache folder and thus working.

[etheruler]

Hi Ruben - Thank you for the information. It explains what I am seeing and I'm glad to hear that it's not a DeTTeCT issue. I may look into cloning the CTI STIX Repository and working offline. It may be useful as a backup option when the CTI site goes down again. Best Regards, e

…

On Thu, Mar 14, 2024 at 3:34 PM Ruben Bouman ***@***.***> wrote: hi @etheruler <https://github.com/etheruler> MITRE's TAXII server is down for already a couple of days... I can't help that. To fix this for now, and also in the future and also to make your runs run faster: you can use the --local-stix-path command line parameter. You can clone the CTI STIX repository (https://github.com/mitre/cti) and use it in DeTT&CT as offline ATT&CK source instead of the TAXII server. The DeTT&CT code base of January 25 uses the same TAXII server... but probably it's working because of cached data. DeTT&CT caches information from TAXII server in the cache folder, so maybe your January 25 version still has a filled cache folder and thus working. — Reply to this email directly, view it on GitHub <#113 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AOET64AZ4LEGH7ZOPBICMHDYYH3VVAVCNFSM6AAAAABEWS5YBSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSOJYGI4DOMJQGM> . You are receiving this because you were mentioned.Message ID: ***@***.***>