DataDog
Support Attack Flow as export format
Mitre's Attack Flow project is a data model for describing sequences of adversary behaviors. It helps defenders understand how adversaries operate and improve their own defensive posture and may lead to DEATH (Detection Engineering And Threat Hunting).
KubeHound has is great in finding various attack paths in a Kubernetes environment. However, it's challenging to further use these inferred attack paths to power other tools. Attack Flow may be a very natural way to build the interface to other tools and hence greatly improve the utility of KubeHound.
Thank you for your contribution; we will look at the Attack Flow specification.
Would you prefer Attack path profiles, concrete attack paths, or both, exportable to Mitre Attack flow?
--
The attack path profile would be like this:
A concrete attack path would be like this:
To be honest, I am not aware of attack flows differentiating between specific paths and profiles. Ideally, the resulting flows could be used as execution plans for emulation frameworks. So more abstract representations have a higher utility (i.e. target deployments vs specific pods). IMO, concrete attack paths are better for post-emulation analysis, i.e. the actions were executed and now detection tools want to match the IoCs (which can be part of the attack path), with the observed data.