Merge pull request #651 from mitre-attack/ics-matrix

ICS Platform Matrix

Author: jondricek

modules/matrices/matrices.py

@@ -61,7 +61,8 @@ def generate_platform_matrices(matrix, notes, side_menu_data=None):
             data["notes"].append(notes.get(matrix_id))
 
     data["platforms"] = [
-        {"name": platform, "path": matrices_config.platform_to_path[platform]} for platform in matrix["platforms"]
+        {"name": platform, "path": matrices_config.platform_to_path[matrix["matrix"]][platform]}
+        for platform in matrix["platforms"]
     ]
     data["navigator_link"] = site_config.navigator_link
 
@@ -139,7 +140,8 @@ def get_sub_matrices(matrix):
     domain_ms = ms[matrix["matrix"]]
     # get relevant techniques
     techniques = util.stixhelpers.get_techniques(domain_ms, matrix["matrix"])
-    platform_techniques = util.buildhelpers.filter_techniques_by_platform(techniques, matrix["platforms"])
+    filter_platforms = matrix.get("filter_platforms", matrix["platforms"])
+    platform_techniques = util.buildhelpers.filter_techniques_by_platform(techniques, filter_platforms)
     platform_techniques = util.buildhelpers.filter_out_subtechniques(platform_techniques)
     platform_techniques = util.buildhelpers.filter_deprecated_revoked(platform_techniques)
     # get relevant tactics
@@ -194,7 +196,7 @@ def transform_technique(technique, tactic_id):
                 obj["subtechniques"] = list(filter(lambda st: len(st) > 0, obj["subtechniques"]))
                 # Filter subtechniques by platform
                 obj["subtechniques"] = util.buildhelpers.filter_techniques_by_platform(
-                    obj["subtechniques"], matrix["platforms"]
+                    obj["subtechniques"], filter_platforms
                 )
                 # remove deprecated and revoked
                 obj["subtechniques"] = util.buildhelpers.filter_deprecated_revoked(obj["subtechniques"])
@@ -224,9 +226,7 @@ def techniques_in_tactic(tactic_id):
             logger.warning(f"Tactic not found or missing shortname: {tactic_id}")
             return []
         # filter platform techniques to those inside of this tactic
-        techniques = list(
-            filter(lambda technique: shortname in phase_names(technique), platform_techniques)
-        )
+        techniques = list(filter(lambda technique: shortname in phase_names(technique), platform_techniques))
         # transform into format required by matrix macro
         return list(map(lambda t: transform_technique(t, tactic_id), techniques))
 

modules/matrices/matrices_config.py

@@ -209,9 +209,48 @@
         "type": "local",
         "path": "ics",
         "matrix": "ics-attack",
-        "platforms": [],
+        "platforms": ["Embedded", "Windows", "Linux", "Network Devices"],
+        # Keep platform links while showing all ICS techniques in the domain matrix.
+        "filter_platforms": [],
         "descr": "Below are the tactics and techniques representing the MITRE ATT&CK<sup>&reg;</sup> Matrix for ICS.",
-        "subtypes": [],
+        "subtypes": [
+            {
+                "name": "Embedded",
+                "type": "local",
+                "matrix": "ics-attack",
+                "path": "ics/embedded",
+                "platforms": ["Embedded"],
+                "descr": "Below are the tactics and techniques representing the MITRE ATT&CK<sup>&reg;</sup> Embedded platform for ICS.",
+                "subtypes": [],
+            },
+            {
+                "name": "Windows",
+                "type": "local",
+                "matrix": "ics-attack",
+                "path": "ics/windows",
+                "platforms": ["Windows"],
+                "descr": "Below are the tactics and techniques representing the MITRE ATT&CK<sup>&reg;</sup> Windows platform for ICS.",
+                "subtypes": [],
+            },
+            {
+                "name": "Linux",
+                "type": "local",
+                "matrix": "ics-attack",
+                "path": "ics/linux",
+                "platforms": ["Linux"],
+                "descr": "Below are the tactics and techniques representing the MITRE ATT&CK<sup>&reg;</sup> Linux platform for ICS.",
+                "subtypes": [],
+            },
+            {
+                "name": "Network Devices",
+                "type": "local",
+                "matrix": "ics-attack",
+                "path": "ics/network-devices",
+                "platforms": ["Network Devices"],
+                "descr": "Below are the tactics and techniques representing the MITRE ATT&CK<sup>&reg;</sup> Network Devices platform for ICS.",
+                "subtypes": [],
+            },
+        ],
     },
 ]
 
@@ -224,17 +263,27 @@
 ]
 
 platform_to_path = {
-    "PRE": "enterprise/pre",
-    "Windows": "enterprise/windows",
-    "macOS": "enterprise/macos",
-    "Linux": "enterprise/linux",
-    "Office Suite": "enterprise/cloud/officesuite",
-    "Identity Provider": "enterprise/cloud/identityprovider",
-    "SaaS": "enterprise/cloud/saas",
-    "IaaS": "enterprise/cloud/iaas",
-    "Network Devices": "enterprise/network-devices",
-    "Containers": "enterprise/containers",
-    "ESXi": "enterprise/esxi",
-    "Android": "mobile/android",
-    "iOS": "mobile/ios",
+    "enterprise-attack": {
+        "PRE": "enterprise/pre",
+        "Windows": "enterprise/windows",
+        "macOS": "enterprise/macos",
+        "Linux": "enterprise/linux",
+        "Office Suite": "enterprise/cloud/officesuite",
+        "Identity Provider": "enterprise/cloud/identityprovider",
+        "SaaS": "enterprise/cloud/saas",
+        "IaaS": "enterprise/cloud/iaas",
+        "Network Devices": "enterprise/network-devices",
+        "Containers": "enterprise/containers",
+        "ESXi": "enterprise/esxi",
+    },
+    "mobile-attack": {
+        "Android": "mobile/android",
+        "iOS": "mobile/ios",
+    },
+    "ics-attack": {
+        "Embedded": "ics/embedded",
+        "Windows": "ics/windows",
+        "Linux": "ics/linux",
+        "Network Devices": "ics/network-devices",
+    },
 }