def test_by_name_works(self):
tech = MitreAttackTechnique.get_by_name(self.mitre_attack,
"Port Knocking")
assert tech is not None
tech = MitreAttackTechnique.get_by_name(self.mitre_attack,
"Absolutely made up name")
assert tech is None
def test_all_searches_returns_list(self):
techniques = MitreAttackTechnique.get_by_name(self.mitre_attack,
"Port Knocking")
assert isinstance(techniques, list)
assert len(techniques) > 1
techniques = MitreAttackTechnique.get_by_name(
self.mitre_attack, "Domain Generation Algorithms")
assert isinstance(techniques, list)
assert len(techniques) == 1
def get_multiple_techniques(mitre_conn, mitre_technique_ids=None, mitre_technique_names=None):
"""
Gets multiple techniques from a comma separated input of IDs or names.
If both are given, the IDs are used.
:param mitre_conn: MitreAttackConnection instance
:param mitre_technique_ids: Comma separated string with MITRE IDs
:param mitre_technique_names: Comma separated string with MITRE names
:return: List of techniques
:rtype: list(MitreAttackTechnique)
"""
if mitre_technique_ids is not None:
# Try id first, because it's less ambiguous
technique_ids = mitre_technique_ids.split(',')
techniques = []
for t_id in technique_ids:
technique = MitreAttackTechnique.get_by_id(mitre_conn, t_id)
if not technique:
raise ValueError("Technique with id {} doesn't exist".format(t_id))
techniques.extend(technique)
else:
# It's possible for multiple tactics to have the same name
# And we want to make sure that all of them are processed in that case
technique_names = mitre_technique_names.split(',')
techniques = []
for name in technique_names:
technique = MitreAttackTechnique.get_by_name(mitre_conn, name)
if not technique:
raise ValueError("Techniques with name {} don't exist".format(name))
techniques.extend(technique)
return techniques
def test_collection_name_included(self):
techniques = MitreAttackTechnique.get_by_name(self.mitre_attack,
"Port Knocking")
assert len(techniques) == 2
assert techniques[0].collection is not None and techniques[
1].collection is not None
assert techniques[0].collection != techniques[1].collection
def test_deprecated_technique_states_so_in_description(self):
"""
Gets tactics with name Impact, and checks that deprecation message was added.
Deprecation flag was added to one of the mocked techniques.
"""
techniques = MitreAttackTechnique.get_by_name(
self.mitre_attack, "Domain Generation Algorithms")
assert any(x.description.startswith("Deprecated") for x in techniques)
def test_mitigation_of_tech(self):
"""
This one isn't mocked, because it would require mocking relationships
:return:
"""
mitigations = MitreAttackTechnique.get_by_name(self.mitre_attack, "Port Knocking")[0]\
.get_mitigations(self.mitre_attack)
assert mitigations is not None
assert len(mitigations)
def test_get_tech_info(self):
data_mocker = MitreQueryMocker()
with patch(
"fn_mitre_integration.lib.mitre_attack.TAXIICollectionSource.query",
data_mocker.query):
tech = MitreAttackTechnique.get_by_name(self.mitre_conn,
"Port Knocking")
assert (tech[0].name == "Port Knocking")
tech = MitreAttackTechnique.get_by_id(self.mitre_conn, "T1205")
assert (tech[0].id == "T1205")
def test_technique_representation_doesnt_have_unsupported_tags(self):
"""
Mocked Domain Generation Algorithms on purpose has added code tags to where they could appear.
"""
techniques = MitreAttackTechnique.get_by_name(
self.mitre_attack, "Domain Generation Algorithms")
dict_reps = [technique.dict_form() for technique in techniques]
# check for every technique's representation that all the field don't have the tag
assert all([("<code>" not in technique_repr[key]
for key in technique_repr)
for technique_repr in dict_reps])