unfetter icon indicating copy to clipboard operation
unfetter copied to clipboard

Design changes to data model, API and screen navigation to support multi frameworks

Open infosec-alchemist opened this issue 6 years ago • 1 comments

Besides MITRE ATTACK, there are other frameworks from MITRE and US Government that should be available to Unfetter. Design how that would operate with the following notes:

  • [x] Attack patterns can reside in multiple frameworks. This allows us to keep relationships to other objects between threat models
  • [x] Unfetter users will have one or more threat frameworks they work on. Assume they only work in one threat framework at a time. Switching between in a top level navigation
  • [x] Should an "assessment" only support one framework at a time? Lean towards "yes"
  • [x] Framework data should be updated through TAXII, github data ingest, or through CRUD pages
  • [ ] Support detailed meta data that describes an entire Framework with "name, owners, description, purpose, etc"
  • [ ] Some threat models may have additional grouping than just the STIX Kill chain object. Need to determine how to support.
  • [x] The kill chain is currently how a threat model is identified. Ensure that still works.
  • [ ] Add the NSA CTF - Ensure that attack patterns that are the same in MITRE and NSA CTF's are linked to indicators, mitigations and threat groups, so that selecting between the two will have content when downloading Unfetter

infosec-alchemist avatar Mar 09 '18 18:03 infosec-alchemist

@infosec-alchemist : I think the last bullet above might be covered in issue #1282, so we could remove this bullet from the issue to ensure there is less overlap.

shawnbertrand avatar Jul 24 '18 14:07 shawnbertrand