Repository navigation
All stimuli in placeholder #4536
Description
Activity
Hi V1D1AN! placeholders in OAEV are created when there is no payload related to these attack patterns, so could you please check that you have a payload in OAEV (check the platform and architecture) related to these OCTI attack patterns, such as T1068?
Doc: https://docs.openaev.io/latest/usage/scenario/security-coverage/?h=sti#stix-fields-used-for-scenario-creationHi Stephanya Casanova (@savacano28) .
Indeed, when I search for T1068, I cannot find it in the payloads.
But if i take the first for exemple ...
I will search "Abuse Nslookup with DNS records"
I don't find anything
Ok, I use the filter for T1059.001
In OpenAEV , i don't found "Abuse Nslookup with DNS records"
In short, I understand that the connection is not made in my scenarios and that they fall into “placeholder.”
I search how recreate all the liaison .... It worked perfectly with OpenBAS.
Reacted by Stephanya CasanovaHi V1D1AN, in order to create the link with the TTP, you can try modify the payload and add TTP like:
If the payload cannot be modified, you can duplicate and modify it.
Thanks for your feedback.
Hi Stephanya Casanova (@savacano28) ,
I must update my 1738 payloads ???When i duplicate a payload ... i try to modify but i can't because the value is good ...
Reacted by Stephanya CasanovaV1D1AN No, it’s only for testing (just to verify that it works). The MITRE ATT&CK and Atomic Red Team connectors will automatically create the payload and add the appropriate TTPs.
Since the payload selection is based also on the target platform (assets), could you please check two small things:
- Which platform is set in this test payload?
- Whether you have a custom OCTI rule with assets in it, and if their platform matches the one used in the payload?
Docs:
https://docs.openaev.io/latest/usage/scenario/security-coverage/#how-openaev-builds-the-scenario
https://docs.openaev.io/latest/usage/default_asset_rules/If these steps don’t solve the issue, we will address the inject matching bug.
Thanks!
Stephanya Casanova (@savacano28) , I will try to create a scenario with your documentation.
In the meantime, I found a quick way to find out if I had the payload.
I'll use T1566.001 as an example.
EDIT :
It works manually ...
Reacted by Stephanya CasanovaHi Stephanya Casanova (@savacano28) , same problem with OpenCTI 6.9.0 , OpenAEV 2.0.6 and XTM-COMPOSER 1.0.1
Reacted by Stephanya CasanovaHi V1D1AN , Could you please let me know which platforms/architectures are included in the Customization -> Default Asset Rules -> Octi tag asset groups?
For a simple test, could you please remove all asset groups associated with this Octi tag, update your report, and then we can check the scenario that is generated?
Thanks,Hi Stephanya Casanova (@savacano28) , thanks for your help.
For the moment , I have this ...
I have suppress and i have this ..
I have import a new report :
The Same :(
Hi Stephanya Casanova (@savacano28) , I tried putting assets back into Octi and it works.
I have test to import a scenario from a report of Alienvault and it work's !!!!!!
I have try with a Group like Equation Group and i have this
I have this configuration
My assets are :
Reacted by Stephanya CasanovaI close the issue because it works with reports of alienvault ...
I'm still looking for why... But for some reports it works... so it must be coming from my OpenCTI database... But I don't see what.Pr Doc related: OpenAEV-Platform/docs#230
Description
Hi the team.
When I import a scenario from OpenCTI to OpenAEV, all my stimuli are in placeholder.
Environment
Reproducible Steps
On OpenCTI , I select a report and i click on the security coverage.
Screenshots (optional)
On OpenCTI
On OpenAEV