Class: ActiveAttack::Playbook

Inherits:
ApplicationRecord show all
Defined in:
app/models/active_attack/playbook.rb

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

.ingest_json(bundle) ⇒ Object 



66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
 
# File 'app/models/active_attack/playbook.rb', line 66

def self.ingest_json(bundle)
  puts "ingesting"
  bundle = ActiveStix::Bundle.ingest_json(bundle, nil)

  intrusion_set_report = bundle.bundled_objects.where(object_type: "ActiveStix::Report").select {|bo| bo.stix_object.labels.map(&:name).include?('intrusion-set')}.first.stix_object
  intrusion_set = intrusion_set_report.report_objects.find {|ro| ro.stix_object.type == 'intrusion-set'}.stix_object
  threat_actor = ActiveStix::ThreatActor.find_or_create_by(name: intrusion_set.name)
  ActiveStix::Relationship.relate(intrusion_set, threat_actor, 'attributed-to')

  campaign_reports = bundle.bundled_objects.where(object_type: "ActiveStix::Report").select {|bo| bo.stix_object.labels.map(&:name).include?('campaign')}.map(&:stix_object)

  campaign_reports.each do |report|
    campaign = report.report_objects.find_by(object_type: 'ActiveStix::Campaign').stix_object
    ActiveStix::Relationship.relate(campaign, intrusion_set, 'attributed-to')
    ActiveStix::Relationship.relate(campaign, threat_actor, 'attributed-to')
  end

  playbook = Playbook.create
  playbook.threat_actor = threat_actor
  playbook.bundle = bundle
  playbook.save

end

Instance Method Details

#as_stix(classification = nil, chess = nil) ⇒ Object 



6
7
8
 
# File 'app/models/active_attack/playbook.rb', line 6

def as_stix(classification = nil, chess = nil)

end

#attack_pattern_campaign_list(phase, row) ⇒ Object 



40
41
42
43
44
45
46
 
# File 'app/models/active_attack/playbook.rb', line 40

def attack_pattern_campaign_list(phase, row)
  attack_pattern = attack_pattern_matrix(phase, row)
  name = attack_pattern ? attack_pattern.name : ""
  campaigns.select do |campaign|
    campaign_attack_patterns[campaign].collect(&:name).include? name
  end.collect(&:stix_id).join(" ")
end

#attack_pattern_matrix(phase, row) ⇒ Object 



57
58
59
60
61
62
63
64
 
# File 'app/models/active_attack/playbook.rb', line 57

def attack_pattern_matrix(phase, row)
  phase = phased_attack_patterns[phase]
  if row < phase.size
    phase[row]
  else
    nil
  end
end

#attack_patterns ⇒ Object 



18
19
20
 
# File 'app/models/active_attack/playbook.rb', line 18

def attack_patterns
  @attack_patterns ||= campaign.attack_patterns
end

#campaign ⇒ Object 



14
15
16
 
# File 'app/models/active_attack/playbook.rb', line 14

def campaign
  @campaign ||= bundle.bundled_objects.find {|b| b.stix_object.type == "campaign"}.stix_object
end

#campaign_attack_patterns ⇒ Object 



31
32
33
34
35
36
37
38
 
# File 'app/models/active_attack/playbook.rb', line 31

def campaign_attack_patterns
  return @campaign_attack_patterns if @campaign_attack_patterns
  @campaign_attack_patterns = {}
  campaigns.each do |campaign|
    @campaign_attack_patterns[campaign] = campaign.attack_patterns
  end
  @campaign_attack_patterns
end

#campaigns ⇒ Object 



10
11
12
 
# File 'app/models/active_attack/playbook.rb', line 10

def campaigns
  @campaigns ||= threat_actor.campaigns
end

#engagement_report(threat_actor) ⇒ Object 



152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
 
# File 'app/models/active_attack/playbook.rb', line 152

def engagement_report(threat_actor)
  bundle = report(threat_actor)
  identity_relationships = threat_actor.source_relationships.where(target_type: "ActiveStix::Identity", relationship_type: "attributed-to")
  identity_relationships.each do |relationship|
    bundle.add(relationship)
    bundle.add(relationship.target)
    relationship.target.source_relationships.where(relationship_type: "employs").each do |employment_rel|
      bundle.add(employment_rel)
      bundle.add(employment_rel.target)
    end
  end

  ActiveStix::Relationship.where(
      source: threat_actor,
      source_type: 'ActiveStix::ThreatActor',
      target_type: 'ActiveStix::ObservedDatum',
      relationship_type: 'related-to',
      ).each do |observed_datum_rel|
    bundle.add(observed_datum_rel)
    bundle.add(observed_datum_rel.target)
  end

  bundle
end

#kill_chain ⇒ Object 



22
23
24
25
 
# File 'app/models/active_attack/playbook.rb', line 22

def kill_chain
  return @kill_chain if @kill_chain
  @kill_chain = attack_patterns.first.kill_chain_phases.first.phase.kill_chain
end

#number_of_rows ⇒ Object 



27
28
29
 
# File 'app/models/active_attack/playbook.rb', line 27

def number_of_rows
  phased_attack_patterns.collect {|k, v| v.size}.max
end

#phased_attack_patterns ⇒ Object 



48
49
50
51
52
53
54
55
 
# File 'app/models/active_attack/playbook.rb', line 48

def phased_attack_patterns
  return @phased_attack_patterns if @phased_attack_patterns
  @phased_attack_patterns = {}
  @kill_chain.phases.each do |phase|
    @phased_attack_patterns[phase.name] = phase.attack_patterns
  end
  @phased_attack_patterns
end

#report(threat_actor) ⇒ Object 



90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
 
# File 'app/models/active_attack/playbook.rb', line 90

def report(threat_actor)
  bundle = ActiveStix::Bundle.create
  if threat_actor.intrusion_sets.empty?
    intrusion_set = ActiveStix::IntrusionSet.find_or_create_by(name: threat_actor.name)
    rel = ActiveStix::Relationship.relate(intrusion_set, threat_actor, "attributed-to")
    bundle.add(rel)
  else
    intrusion_set = threat_actor.intrusion_sets.last
    bundle.add(ActiveStix::Relationship.relate(intrusion_set, threat_actor, 'attributed-to'))
  end

  ActiveStix::Relationship.where(target: intrusion_set, source_type: "ActiveStix::Campaign", relationship_type: 'attributed-to').all.each do |rel|
    bundle.add(rel.source)
  end


  campaign_reports = threat_actor.campaigns.collect do |campaign|
    report = ActiveStix::Report.create
    label = ActiveStix::OpenVocabulary.find_or_create_by(name: 'report-labels').labels.find_or_create_by(name: 'campaign')
    report.labels << label
    report.add_stix_object(campaign)
    bundle.add(campaign)
    campaign.attack_pattern_relationships.each do |attack_pattern_relationship|
      report.add_stix_object(attack_pattern_relationship)
      report.add_stix_object(attack_pattern_relationship.target)
      bundle.add(attack_pattern_relationship)
      bundle.add(attack_pattern_relationship.target)
      attack_pattern_relationship.target.indicator_relationships.each do |indicator_relationship|
        report.add_stix_object(indicator_relationship)
        report.add_stix_object(indicator_relationship.source)
        bundle.add(indicator_relationship)
        bundle.add(indicator_relationship.source)
      end
    end

    campaign.indicator_relationships.each do |indicator_relationship|
      report.add_stix_object(indicator_relationship)
      report.add_stix_object(indicator_relationship.source)
      bundle.add(indicator_relationship)
      bundle.add(indicator_relationship.source)
    end
    bundle.add(report)
    report
  end

  intrusion_set_report = ActiveStix::Report.create
  label = ActiveStix::OpenVocabulary.find_or_create_by(name: 'report-labels').labels.find_or_create_by(name: 'intrusion-set')
  intrusion_set_report.labels << label
  intrusion_set_report.add_stix_object(intrusion_set)
  campaign_reports.each do |campaign_report|
    intrusion_set_report.add_stix_object(campaign_report)
  end

  bundle.add(threat_actor)
  bundle.add(intrusion_set)
  bundle.add(intrusion_set_report)

  self.bundle = bundle
  save
  bundle
end