unfetter icon indicating copy to clipboard operation
unfetter copied to clipboard

Implement the `revoked` STIX property

Open infosec-alchemist opened this issue 6 years ago • 3 comments

The April 2018 version of Enterprise ATT&CK was added back in May 2018, but the new property revoked, while added in the STIX API and in the Mongoose and Swagger models, was not incorporated into Unfetter to allow exposure to the end user. This issue serves to add in support for revoked and have it behave like a deleted property.

infosec-alchemist avatar May 15 '18 00:05 infosec-alchemist

As far as I can see, the only columns we are missing from the ATT&CK April 2018 update are revoked and x_mitre_deprecated, and only revoked is actually used in the April 2018 update. Both of these fields are referenced in the USAGE.md for ATT&CK Enterprise.

shawnbertrand avatar Oct 15 '18 15:10 shawnbertrand

Revoked is already represented in the stix repo - we'll just add it to the filter builder to ensure revoked objects are not included in API calls by default.

shawnbertrand avatar Oct 18 '18 13:10 shawnbertrand

This will remain open for now, which means all STIX objects in Unfetter - revoked or not - will be available and displayed. In the future, this issue should be resolved by incorporating the revoked property much like a deleted property would.

shawnbertrand avatar Oct 18 '18 21:10 shawnbertrand