Skip to content

Commit

Permalink
Update USAGE-CAPEC.md
Browse files Browse the repository at this point in the history
indicate that 2.1 is also available
  • Loading branch information
rpiazza authored Jul 16, 2021
1 parent 7cdfd36 commit eb439b3
Showing 1 changed file with 9 additions and 9 deletions.
18 changes: 9 additions & 9 deletions USAGE-CAPEC.md
Original file line number Diff line number Diff line change
@@ -1,16 +1,16 @@
# Introduction
This document describes how to query and manipulate CAPEC data in this repository. Machine-readable CAPEC data is available in
a JSON-based [STIX 2.0](https://oasis-open.github.io/cti-documentation/stix/intro) format.
a JSON-based [STIX 2.0](https://oasis-open.github.io/cti-documentation/stix/intro) and STIX 2.1 formats.

STIX 2.0 is just JSON and so should be very accessible from Python and other programming languages. If you are using Python, the [python-stix2](https://github.com/oasis-open/cti-python-stix2) library can help you work with the content as shown in the examples below.
STIX 2.x is just JSON and so should be very accessible from Python and other programming languages. If you are using Python, the [python-stix2](https://github.com/oasis-open/cti-python-stix2) library can help you work with the content as shown in the examples below.

# Mapping Concepts
First, we must describe how CAPEC objects and properties map to STIX 2.0 objects and properties.
First, we must describe how CAPEC objects and properties map to STIX 2.x objects and properties.

## Objects
In CAPEC, the main object is the Attack Pattern. Most Attack Pattern also have Mitigations. There are other types of objects in CAPEC (e.g, Category, View, etc.), but these are not (currently) part of the repository.

The STIX types are found as literal strings assigned to the `type` property of the STIX JSON object. The STIX 2.0 object called "Attack Pattern" corresponds to a CAPEC attack pattern. In STIX 2.0, there are objects called "Course(s) of Action" which can be used to describe CAPEC Mitigations.
The STIX types are found as literal strings assigned to the `type` property of the STIX JSON object. The STIX 2.x object called "Attack Pattern" corresponds to a CAPEC attack pattern. In STIX 2.x, there are objects called "Course(s) of Action" which can be used to describe CAPEC Mitigations.

## Properties
The following is a table mapping of CAPEC properties to STIX properties. Some of these properties are standard STIX properties, while others were custom-created for compatibility with CAPEC. These properties are accessed from STIX objects as JSON properties.
Expand Down Expand Up @@ -38,11 +38,11 @@ CAPEC 3.0 properties not mapped (at this time): **Execution\_Flow**, **Indicato

CAPEC 3.0 properties not appropriate to map: **Status**

# Using Python and STIX 2.0
In this section, we will describe how to query and manipulate CAPEC data that has been stored in a STIX 2.0 repository. A Python library has been created for using and creating STIX 2.0 data by the OASIS Technical Committee for Cyber Threat Intelligence, which develops the STIX standard. This library abstracts storage and transport details so that the same code can be used to interact with data locally on the filesystem or in memory, or remotely via [TAXII](https://oasis-open.github.io/cti-documentation/taxii/intro). The source code, installation instructions, and basic documentation for the library can be found [here](https://github.com/oasis-open/cti-python-stix2). There is a more thorough [API documentation](http://stix2.readthedocs.io/en/latest/overview.html) as well.
# Using Python and STIX 2.x
In this section, we will describe how to query and manipulate CAPEC data that has been stored in a STIX 2.x repository. A Python library has been created for using and creating STIX 2.x data by the OASIS Technical Committee for Cyber Threat Intelligence, which develops the STIX standard. This library abstracts storage and transport details so that the same code can be used to interact with data locally on the filesystem or in memory, or remotely via [TAXII](https://oasis-open.github.io/cti-documentation/taxii/intro). The source code, installation instructions, and basic documentation for the library can be found [here](https://github.com/oasis-open/cti-python-stix2). There is a more thorough [API documentation](http://stix2.readthedocs.io/en/latest/overview.html) as well.

## Python Library
To begin querying STIX 2.0 data, you must first have a [DataSource](http://stix2.readthedocs.io/en/latest/guide/datastore.html). For these examples, we will simply use a [FileSystemSource](http://stix2.readthedocs.io/en/latest/guide/filesystem.html). The CAPEC corpus must first be cloned or downloaded from [GitHub](https://github.com/mitre/cti).
To begin querying STIX 2.x data, you must first have a [DataSource](http://stix2.readthedocs.io/en/latest/guide/datastore.html). For these examples, we will simply use a [FileSystemSource](http://stix2.readthedocs.io/en/latest/guide/filesystem.html). The CAPEC corpus must first be cloned or downloaded from [GitHub](https://github.com/mitre/cti).

### Get all Attack Patterns
Once the stix2 Python library is installed and the corpus is acquired, we need to open the DataStore for querying:
Expand All @@ -52,7 +52,7 @@ from stix2 import FileSystemSource
fs = FileSystemSource('./cti/capec')
```

When creating the DataSource, the keyword agrument `allow_custom` must be set to `True`. This is because the CAPEC data uses several custom properties which are not part of the STIX 2.0 specification (`x_capec_prerequisites`, `x_capec_example_instances`, etc).
When creating the DataSource, the keyword agrument `allow_custom` must be set to `True`. This is because the CAPEC data uses several custom properties which are not part of the STIX 2.x specification (`x_capec_prerequisites`, `x_capec_example_instances`, etc).

To perform a query, we must define a [Filter](http://stix2.readthedocs.io/en/latest/guide/datastore.html#Filters). As of this writing, a filter must, at a minimum, specify object `id`'s or an object `type`. The following filter can be used to retrieve all CAPEC attack patterns:

Expand All @@ -73,7 +73,7 @@ Notice that the `query` function takes a **list** of filters. These filters are


### Get any object by CAPEC ID
In this example, the STIX 2.0 type must be passed into the function. Here we query for the attack pattern with ID `66` (*SQL Injection*).
In this example, the STIX 2.x type must be passed into the function. Here we query for the attack pattern with ID `66` (*SQL Injection*).

```python
def get_attack_pattern_by_capec_id(src, capec_id):
Expand Down

0 comments on commit eb439b3

Please sign in to comment.