active_attack 0.1.14

data/app/overrides/models/active_stix/tool_override.rb

@@ -0,0 +1,36 @@
+ActiveStix::Tool.class_eval do
+  has_many :builds, class_name: "ActiveAttack::Build", as: :buildable
+  has_many :platforms, through: :builds, class_name: "ActiveAttack::Platform"
+
+  def self.expected_keys
+    [
+        'description',
+        'external_references',
+        'object_marking_refs',
+        'x_mitre_aliases',
+        'x_mitre_platforms',
+        'labels',
+        'x_mitre_version'
+    ]
+  end
+
+
+  def self.x_mitre_aliases(tool, obj)
+    tool.aliases = obj['x_mitre_aliases']
+  end
+
+  def self.x_mitre_platforms(tool, obj)
+    obj['x_mitre_platforms'].each do |plat|
+      platform = ActiveAttack::Platform.create_platform(plat)
+      # todo make sure these are stix_ids
+      tool.platforms << platform unless ActiveAttack::Build.find_by(platform_id: platform.id, buildable_id: tool.id)
+    end
+  end
+
+  def self.x_mitre_version(tool, obj)
+    # todo
+    # version = ActiveAttack::Version.create_version(obj['x_mitre_version'])
+    # tool.versions << version unless ActiveAttack::ToolVersion.find_by(version_id: version.id, tool_id: tool.id)
+  end
+
+end

data/app/views/active_attack/matrices/_form.html.erb

@@ -0,0 +1,27 @@
+<%= form_with(model: attack_matrix, local: true) do |form| %>
+  <% if attack_matrix.errors.any? %>
+    <div id="error_explanation">
+      <h2><%= pluralize(attack_matrix.errors.count, "error") %> prohibited this attack_matrix from being saved:</h2>
+
+      <ul>
+      <% attack_matrix.errors.full_messages.each do |message| %>
+        <li><%= message %></li>
+      <% end %>
+      </ul>
+    </div>
+  <% end %>
+
+  <div class="field">
+    <%= form.label :uploaded_file, 'Upload your file.' %><br/>
+    <%= form.file_field :uploaded_file %>
+  </div>
+
+  <div class="field">
+    <%= form.label :name %>
+    <%= form.text_field :name %>
+  </div>
+
+  <div class="actions">
+    <%= form.submit %>
+  </div>
+<% end %>

data/app/views/active_attack/matrices/_stix_attack_matrix.json.jbuilder

@@ -0,0 +1,2 @@
+json.extract! stix_attack_matrix, :id, :stix_bundle_id, :created_at, :updated_at
+json.url stix_attack_matrix_url(stix_attack_matrix, format: :json)

data/app/views/active_attack/matrices/edit.html.erb

@@ -0,0 +1,6 @@
+<h1>Editing Stix Attack Matrix</h1>
+
+<%= render 'form', stix_attack_matrix: @attack_attack_matrix %>
+
+<%= link_to 'Show', @attack_attack_matrix %> |
+<%= link_to 'Back', attack_attack_matrices_path %>

data/app/views/active_attack/matrices/index.html.erb

@@ -0,0 +1,16 @@
+<p id="notice"><%= notice %></p>
+
+
+<h1>Att&ck Matrix</h1>
+
+
+<table>
+  <% @attack_matrices.each do |matrix| %>
+    <tr>
+      <td>
+        <%= link_to matrix.name, matrix %>
+      </td>
+    </tr>
+  <% end %>
+</table>
+<%= link_to 'New', new_attack_matrix_path %>

data/app/views/active_attack/matrices/index.json.jbuilder

@@ -0,0 +1 @@
+json.array! @attack_attack_matrices, partial: "attack_attack_matrices/attack_attack_matrix", as: :attack_attack_matrix

data/app/views/active_attack/matrices/new.html.erb

@@ -0,0 +1,5 @@
+<h1>New Attack Matrix</h1>
+
+<%= render 'form', attack_matrix: @attack_matrix %>
+
+<%= link_to 'Back', attack_matrices_path %>

data/app/views/active_attack/matrices/show.html.erb

@@ -0,0 +1,33 @@
+<p id="notice"><%= notice %></p>
+ <h1> <%= @attack_matrix.name %> </h1>
+
+<% bundle_phases = [] %>
+<% @attack_matrix.stix_bundle.bundled_objects.where("stix_object_type = 'ActiveStix::AttackPattern'").each do | ap_ref | %>
+  <% bundle_phases << ActiveStix::AttackPattern.where(stix_id: ap_ref.stix_object_ref).first.phases.first %>
+<% end %>
+<% bundle_phases = bundle_phases.uniq.sort_by(&:rank) %>
+<table style="width:100%;text-align:center;border:1px solid black">
+  <tr>
+    <% bundle_phases.each do | phase | %>
+      <th style="text-align:center;width:5%;border:1px solid black"><%=  phase.name %></th>
+    <% end %>
+  </tr>
+
+  <tr>
+    <% bundle_phases.each do | phase | %>
+      <td valign="top">
+        <table style="width:100%">
+          <% phase.attack_patterns.uniq.each do | attack | %>
+            <tr>
+              <td style="width:5%;border:1px solid black;font-size:75%"> <%= link_to attack.name, attack %> </td>
+            </tr>
+          <% end %>
+        </table>
+      </td>
+    <% end %>
+  </tr>
+</table>
+
+<br>
+
+<%= link_to 'New Stix Attack Matrix', new_attack_matrix_path %>

data/app/views/active_attack/matrices/show.json.jbuilder

@@ -0,0 +1 @@
+json.partial! "attack_attack_matrices/attack_attack_matrix", attack_attack_matrix: @attack_attack_matrix

data/app/views/active_attack/playbooks/_attack_playbook.json.jbuilder

@@ -0,0 +1,2 @@
+json.extract! attack_playbook, :id, :name, :stix_bundle_id, :created_at, :updated_at
+json.url attack_playbook_url(attack_playbook, format: :json)

data/app/views/active_attack/playbooks/_form.html.erb

@@ -0,0 +1,32 @@
+<%= form_with(model: attack_playbook, local: true) do |form| %>
+  <% if attack_playbook.errors.any? %>
+    <div id="error_explanation">
+      <h2><%= pluralize(attack_playbook.errors.count, "error") %> prohibited this attack_playbook from being saved:</h2>
+
+      <ul>
+      <% attack_playbook.errors.full_messages.each do |message| %>
+        <li><%= message %></li>
+      <% end %>
+      </ul>
+    </div>
+  <% end %>
+
+  <div class="field">
+    <%= form.label :name %>
+    <%= form.text_field :name %>
+  </div>
+
+<!--  <div class="field">-->
+    <%#= form.label :stix_bundle_id %>
+    <%#= form.text_field :stix_bundle_id %>
+<!--  </div>-->
+
+  <div class="field">
+    <%= form.label :uploaded_file, 'Upload your file.' %><br/>
+    <%= form.file_field :uploaded_file %>
+  </div>
+
+  <div class="actions">
+    <%= form.submit %>
+  </div>
+<% end %>

data/app/views/active_attack/playbooks/edit.html.erb

@@ -0,0 +1,6 @@
+<h1>Editing Attack Playbook</h1>
+
+<%= render 'form', attack_playbook: @attack_playbook %>
+
+<%= link_to 'Show', @attack_playbook %> |
+<%= link_to 'Back', attack_playbooks_path %>

data/app/views/active_attack/playbooks/index.html.erb

@@ -0,0 +1,38 @@
+<div class="container-fluid">
+  <div class="wrapper" data-controller="playbooks">
+    <div class="box header">
+      <span>PLAYBOOK VIEWER</span></div>
+    <div class="box sidebar">
+      <a href="https://unit42.paloaltonetworks.com/" target="_blank"></a>
+      <!--<span>PLAYBOOKS</span><br>-->
+      <% @playbooks.each do |playbook| %>
+        <div class="btn playbook"><%= link_to playbook.threat_actor.name, playbook %></div>
+      <% end %>
+
+
+
+      <!--<div class="btn playbook" id="playbook_name" pb_file="name.json" onclick="">NAME</div>-->
+
+    </div>
+    <div class="box inside" data-controller="campaign">
+    </div>
+    <div class="info">
+
+
+    </div>
+    <div class="container-fluid" data-controller="matrix">
+    </div>
+
+    <div class="phasescontainer">
+
+    </div>
+    <div class="box footer">
+      Inspired by Palo Alto Networks - Unit 42
+      <br><a style="color:#95989a" href="https://attack.mitre.org/wiki/Main_Page">Mitre ATT&CK™</a>
+      | <a style="color:#95989a" href="https://oasis-open.github.io/cti-documentation/stix/intro">STIX 2.0</a>
+    </div>
+  </div>
+</div>
+<% content_for :header do %>
+  <%= stylesheet_link_tag "active_attack/playbooks", media: "all" %>
+<% end %>

data/app/views/active_attack/playbooks/index.json.jbuilder

@@ -0,0 +1 @@
+json.array! @attack_playbooks, partial: "attack_playbooks/attack_playbook", as: :attack_playbook

data/app/views/active_attack/playbooks/new.html.erb

@@ -0,0 +1,5 @@
+<h1>New Attack Playbook</h1>
+
+<%= render 'form', attack_playbook: @attack_playbook %>
+
+<%= link_to 'Back', attack_playbooks_path %>

data/app/views/active_attack/playbooks/show.html.erb

@@ -0,0 +1,70 @@
+<div class="container-fluid">
+  <div class="wrapper" data-controller="playbooks">
+    <div class="box header">
+      <span>PLAYBOOK VIEWER</span></div>
+    <div class="box sidebar">
+      <a href="https://unit42.paloaltonetworks.com/" target="_blank"></a>
+      <!--<span>PLAYBOOKS</span><br>-->
+      <% @playbooks.each do |playbook| %>
+        <div class="btn playbook"><%= link_to playbook.threat_actor.name, playbook %></div>
+      <% end %>
+
+
+
+      <!--<div class="btn playbook" id="playbook_name" pb_file="name.json" onclick="">NAME</div>-->
+
+    </div>
+    <div class="box inside" data-controller="campaign">
+      <div class="box description">
+        <% @playbook.campaigns.each_with_index do |campaign, i| %>
+          <span data-target="campaign.description" id="campaign-<%= i %>" class="filter--notUsed"><%= campaign.description %></span>
+        <% end %>
+      </div>
+      <div class="box timeline">
+        <% @playbook.campaigns.each_with_index do |campaign,i| %>
+          <div class="timeline_btn btn btn-report"  data-action="click->campaign#view click->playbooks#updateMatrix" data-target="campaign"  index="<%= i %>" id="<%= campaign.stix_id%>" campaign_id="<%= campaign.stix_id%>" >
+              <%= campaign.name %>
+          </div>
+        <% end %>
+      </div>
+    </div>
+    <div class="info">
+
+
+    </div>
+    <div class="container-fluid" data-controller="matrix">
+      <button data-action="click->matrix#playbook">
+        Filter
+      </button>
+      <div class="row">
+        <% @playbook.kill_chain.phases.each do |phase| %>
+          <div class="col header kill-chain-phase-header rounded border"><%= phase.name %></div>
+        <% end %>
+      </div>
+      <% 0.upto(@playbook.number_of_rows - 1).each do |row| %>
+        <div data-target="matrix.row playbooks.row" class="row">
+          <% @playbook.kill_chain.phases.each do |phase| %>
+            <div class="col rounded border">
+              <span data-target="matrix.attackPattern playbooks.attackPattern" class="attack-pattern <%= campaign_list(phase.name, row) %>"><%= @playbook.attack_pattern_matrix(phase.name, row) %></span>
+            </div>
+          <% end %>
+        </div>
+      <% end %>
+    </div>
+
+    <div class="phasescontainer">
+
+    </div>
+    <div class="box footer">
+      Inspired by Palo Alto Networks - Unit 42
+      <br><a style="color:#95989a" href="https://attack.mitre.org/wiki/Main_Page">Mitre ATT&CK™</a>
+      | <a style="color:#95989a" href="https://oasis-open.github.io/cti-documentation/stix/intro">STIX 2.0</a>
+    </div>
+  </div>
+</div>
+<% content_for :header do %>
+  <script src="https://unpkg.com/stimulus/dist/stimulus.umd.js"></script>
+  <%= stylesheet_link_tag "active_attack/playbooks", media: "all" %>
+<% end %>
+<%= javascript_include_tag "active_attack/application", media: "all" %>
+

data/app/views/active_attack/playbooks/show.json.jbuilder

@@ -0,0 +1 @@
+json.partial! "attack_playbooks/attack_playbook", attack_playbook: @attack_playbook

data/app/views/active_attack/tactics/_form.html.erb

@@ -0,0 +1,42 @@
+<%= form_with(model: tactic, local: true) do |form| %>
+  <% if tactic.errors.any? %>
+    <div id="error_explanation">
+      <h2><%= pluralize(tactic.errors.count, "error") %> prohibited this tactic from being saved:</h2>
+
+      <ul>
+      <% tactic.errors.full_messages.each do |message| %>
+        <li><%= message %></li>
+      <% end %>
+      </ul>
+    </div>
+  <% end %>
+
+  <div class="field">
+    <%= form.label :stix_id %>
+    <%= form.text_field :stix_id %>
+  </div>
+
+  <div class="field">
+    <%= form.label :name %>
+    <%= form.text_field :name %>
+  </div>
+
+  <div class="field">
+    <%= form.label :description %>
+    <%= form.text_area :description %>
+  </div>
+
+  <div class="field">
+    <%= form.label :shortname %>
+    <%= form.text_field :shortname %>
+  </div>
+
+  <div class="field">
+    <%= form.label :created_by_ref %>
+    <%= form.text_field :created_by_ref %>
+  </div>
+
+  <div class="actions">
+    <%= form.submit %>
+  </div>
+<% end %>

data/app/views/active_attack/tactics/edit.html.erb

@@ -0,0 +1,6 @@
+<h1>Editing Tactic</h1>
+
+<%= render 'form', tactic: @tactic %>
+
+<%= link_to 'Show', @tactic %> |
+<%= link_to 'Back', tactics_path %>

data/app/views/active_attack/tactics/index.html.erb

@@ -0,0 +1,35 @@
+<p id="notice"><%= notice %></p>
+
+<h1>Tactics</h1>
+
+<table>
+  <thead>
+    <tr>
+      <th>Stix</th>
+      <th>Name</th>
+      <th>Description</th>
+      <th>Shortname</th>
+      <th>Created by ref</th>
+      <th colspan="3"></th>
+    </tr>
+  </thead>
+
+  <tbody>
+    <% @tactics.each do |tactic| %>
+      <tr>
+        <td><%= tactic.stix_id %></td>
+        <td><%= tactic.name %></td>
+        <td><%= tactic.description %></td>
+        <td><%= tactic.shortname %></td>
+        <td><%= tactic.created_by_ref %></td>
+        <td><%= link_to 'Show', tactic %></td>
+        <td><%= link_to 'Edit', edit_tactic_path(tactic) %></td>
+        <td><%= link_to 'Destroy', tactic, method: :delete, data: { confirm: 'Are you sure?' } %></td>
+      </tr>
+    <% end %>
+  </tbody>
+</table>
+
+<br>
+
+<%= link_to 'New Tactic', new_tactic_path %>

data/app/views/active_attack/tactics/new.html.erb

@@ -0,0 +1,5 @@
+<h1>New Tactic</h1>
+
+<%= render 'form', tactic: @tactic %>
+
+<%= link_to 'Back', tactics_path %>

data/app/views/active_attack/tactics/show.html.erb

@@ -0,0 +1,29 @@
+<p id="notice"><%= notice %></p>
+
+<p>
+  <strong>Stix:</strong>
+  <%= @tactic.stix_id %>
+</p>
+
+<p>
+  <strong>Name:</strong>
+  <%= @tactic.name %>
+</p>
+
+<p>
+  <strong>Description:</strong>
+  <%= @tactic.description %>
+</p>
+
+<p>
+  <strong>Shortname:</strong>
+  <%= @tactic.shortname %>
+</p>
+
+<p>
+  <strong>Created by ref:</strong>
+  <%= @tactic.created_by_ref %>
+</p>
+
+<%= link_to 'Edit', edit_tactic_path(@tactic) %> |
+<%= link_to 'Back', tactics_path %>

data/app/views/layouts/active_attack/application.html.erb

@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Active attack</title>
+  <%= csrf_meta_tags %>
+  <%= csp_meta_tag %>
+
+  <%= stylesheet_link_tag "active_attack/application", media: "all" %>
+</head>
+<body>
+
+<%= yield %>
+
+</body>
+</html>