Skip to content

Commit

Permalink
added another setof tables to attacktoexcel
Browse files Browse the repository at this point in the history
  • Loading branch information
vsun757 committed Jul 12, 2023
1 parent 588e86b commit 9a1bbde
Showing 1 changed file with 42 additions and 15 deletions.
57 changes: 42 additions & 15 deletions docs/attacktoexcel.rst
Original file line number Diff line number Diff line change
Expand Up @@ -43,27 +43,54 @@ Example execution targeting a specific domain and version:
attackToExcel provides the means by which to convert/extract the ATT&CK STIX data to Excel spreadsheets. A brief
overview of the available methods follows.

| method name | arguments | usage |
|:------------|:----------|:------|
|get_stix_data|`domain`: the domain of ATT&CK to fetch data from <br> `version`: optional parameter indicating which version to fetch data from (such as "v8.1"). If omitted retrieves the most recent version of ATT&CK. <br>`remote`: optional parameter that provides a URL of a remote ATT&CK Workbench instance to grab data from.| Retrieves the ATT&CK STIX data for the specified version and returns it as a MemoryStore object|
|build_dataframes| `src`: MemoryStore or other stix2 DataSource object holding domain data<br> `domain`: domain of ATT&CK that `src` corresponds to| Builds a Pandas DataFrame collection as a dictionary, with keys for each type, based on the ATT&CK data provided|
|write_excel| `dataframes`: pandas DataFrame dictionary (generated by build_dataframes) <br> `domain`: domain of ATT&CK that `dataframes` corresponds to <br> `version`: optional parameter indicating which version of ATT&CK is in use <br> `output_dir`: optional parameter specifying output directory| Writes out DataFrame based ATT&CK data to excel files|
|export| `domain`: the domain of ATT&CK to download <br> `version`: optional parameter specifying which version of ATT&CK to download <br> `output_dir`: optional parameter specifying output directory| Downloads ATT&CK data from MITRE/CTI and exports it to Excel spreadsheets |

* - method name
- arguments
- usage
* - get_stix_data
- `domain`: the domain of ATT&CK to fetch data from <br> `version`: optional parameter indicating which version to fetch data from (such as "v8.1"). If omitted retrieves the most recent version of ATT&CK. <br>`remote`: optional parameter that provides a URL of a remote ATT&CK Workbench instance to grab data from.
- Retrieves the ATT&CK STIX data for the specified version and returns it as a MemoryStore object
* - build_dataframes
- `src`: MemoryStore or other stix2 DataSource object holding domain data<br> `domain`: domain of ATT&CK that `src` corresponds to
- Builds a Pandas DataFrame collection as a dictionary, with keys for each type, based on the ATT&CK data provided
* - write_excel
- `dataframes`: pandas DataFrame dictionary (generated by build_dataframes) <br> `domain`: domain of ATT&CK that `dataframes` corresponds to <br> `version`: optional parameter indicating which version of ATT&CK is in use <br> `output_dir`: optional parameter specifying output directory
- Writes out DataFrame based ATT&CK data to excel files
* - export
- `domain`: the domain of ATT&CK to download <br> `version`: optional parameter specifying which version of ATT&CK to download <br> `output_dir`: optional parameter specifying output directory
- Downloads ATT&CK data from MITRE/CTI and exports it to Excel spreadsheets

**stixToDf**

stixToDf provides various methods to process and manipulate the STIX data in order to create [Pandas](https://pandas.pydata.org/) DataFrames for
processing. A brief overview of these methods follows.

| method name | arguments | usage |
|:------------|:----------|:------|
|techniquesToDf|`src`: MemoryStore or other stix2 DataSource object holding domain data<br> `domain`: domain of ATT&CK that `src` corresponds to | Parses STIX techniques from the provided data and returns corresponding Pandas DataFrames.|
|tacticsToDf|`src`: MemoryStore or other stix2 DataSource object holding domain data<br> `domain`: domain of ATT&CK that `src` corresponds to | Parses STIX tactics from the provided data and returns corresponding Pandas DataFrames.|
|softwareToDf|`src`: MemoryStore or other stix2 DataSource object holding domain data<br> `domain`: domain of ATT&CK that `src` corresponds to | Parses STIX software from the provided data and returns corresponding Pandas DataFrames.|
|groupsToDf|`src`: MemoryStore or other stix2 DataSource object holding domain data<br> `domain`: domain of ATT&CK that `src` corresponds to | Parses STIX groups from the provided data and returns corresponding Pandas DataFrames.|
|mitigationsToDf|`src`: MemoryStore or other stix2 DataSource object holding domain data<br> `domain`: domain of ATT&CK that `src` corresponds to | Parses STIX mitigations from the provided data and returns corresponding Pandas DataFrames.|
|relationshipsToDf|`src`: MemoryStore or other stix2 DataSource object holding domain data<br> `domain`: domain of ATT&CK that `src` corresponds to | Parses STIX relationships from the provided data and returns corresponding Pandas DataFrames.|
|matricesToDf|`src`: MemoryStore or other stix2 DataSource object holding domain data<br> `domain`: domain of ATT&CK that `src` corresponds to | Parses STIX matrices from the provided data and returns a parsed matrix structure of the form `[{matrix, name, description, merge, border}, ...]`|

* - method name
- arguments
- usage
* - techniquesToDf
- `src`: MemoryStore or other stix2 DataSource object holding domain data<br> `domain`: domain of ATT&CK that `src` corresponds to
- Parses STIX techniques from the provided data and returns corresponding Pandas DataFrames.
* - tacticsToDf
- `src`: MemoryStore or other stix2 DataSource object holding domain data<br> `domain`: domain of ATT&CK that `src` corresponds to
- Parses STIX tactics from the provided data and returns corresponding Pandas DataFrames.
* - softwareToDf
- `src`: MemoryStore or other stix2 DataSource object holding domain data<br> `domain`: domain of ATT&CK that `src` corresponds to
- Parses STIX software from the provided data and returns corresponding Pandas DataFrames.
* - groupsToDf
- `src`: MemoryStore or other stix2 DataSource object holding domain data<br> `domain`: domain of ATT&CK that `src` corresponds to
- Parses STIX groups from the provided data and returns corresponding Pandas DataFrames.
* - mitigationsToDf
- `src`: MemoryStore or other stix2 DataSource object holding domain data<br> `domain`: domain of ATT&CK that `src` corresponds to
- Parses STIX mitigations from the provided data and returns corresponding Pandas DataFrames.
* - relationshipsToDf
- `src`: MemoryStore or other stix2 DataSource object holding domain data<br> `domain`: domain of ATT&CK that `src` corresponds to
- Parses STIX relationships from the provided data and returns corresponding Pandas DataFrames.
* - matricesToDf
- `src`: MemoryStore or other stix2 DataSource object holding domain data<br> `domain`: domain of ATT&CK that `src` corresponds to
- Parses STIX matrices from the provided data and returns a parsed matrix structure of the form `[{matrix, name, description, merge, border}, ...]`


**Spreadsheet format**

Expand Down

0 comments on commit 9a1bbde

Please sign in to comment.