The atomic-validation-criteria from secureworks

atomic-validation-criteria's People

Contributors

Stargazers

Watchers

atomic-validation-criteria's Issues

need CSV linter

We should have a script that can do the following:

verify that an MR is not breaking CSV format
verify that each CSV line is using the right pseudo-schema fields and values
no duplicate tests
ATR test reference Number, Guid, Names match
operators are supported (~=, =, *=)

For example, the following CSV lines get parsed into objects in harness

_E_,File,READ,path*=/proc/[0-9]*/mem
_E_,Process,cmdline*=python.*/T1003.007/src/dump_heap.py

schema

type FieldCriteria struct {
	FieldName string              `json:"field"`
	Op        string              `json:"op"`
	Value     string              `json:"value"`
}


// _E_,Process,cmdline=echo "# THIS IS A COMMENT"
// _E_,File,WRITE,path=/etc/ufw/ufw.conf
type ExpectedEvent struct {
	Id          string            `json:"id"`
	EventType   string            `json:"event_type"`
	SubType     string            `json:"sub_type,omitempty"`
	FieldChecks []FieldCriteria   `json:"field_checks"`
	IsMaybe     bool              `json:"is_maybe,omitempty"`


	Matches     []*SimpleEvent   `json:"matches,omitempty"`
}

// _C_,Process,Pipe,0,1
type CorrelationRow struct {
	Id string                     `json:"id"`
	Type string                   `json:"type"`
	SubType string                `json:"sub_type"`
	EventIndexes []string         `json:"indexes"`
	IsMet bool                    `json:"is_met"`
}

// ARG,remote_host,victim-host
type ArgRow struct {
	Name string
	Value string
}

type MitreTestCriteria struct {
	Technique        string              `json:"technique"`
	TestIndex        uint                `json:"test_index"`
	TestName         string              `json:"test_name"`
	ExpectedEvents   []*ExpectedEvent     `json:"expected_events"`
	ExpectedCorrelations []*CorrelationRow  `json:"exp_correlations,omitempty"`
}