ATTACK CTI Libary
Project description
ATT&CK Python Client
A Python module to access up to date ATT&CK content available in STIX via public TAXII server. This project leverages the python classes and functions of the cti-python-stix2 and cti-taxii-client libraries developed by MITRE.
Goals
- Provide an easy way to access and interact with up to date ATT&CK content available in STIX via public TAXII server
- Allow security analysts to quickly explore ATT&CK content and apply it in their daily operations
- Allow the integration of ATT&Ck content with other platforms to host up to date information from the framework
- Help security analysts during the transition from the ATT&CK MediaWiki API to the STIX/TAXII 2.0 API
- Learn STIX2 and TAXII Client Python libraries
Current Status: Beta
The project is currently in a beta stage, which means that the code and the functionality is changing, but the current main functions are stabilising. I would love to get your feedback to make it a better project.
Resources
- MITRE CTI
- OASIS CTI TAXII Client
- OASIS CTI Python STIX2
- MITRE ATT&CK Framework
- ATT&CK MediaWiki API
- Invoke-ATTACKAPI
- Mitre-Attack-API
Getting Started
Requirements
Python 3+ or 2.7
Installation
You can install it via PIP:
pip install attackcti
Or you can also do the following:
git clone https://github.com/Cyb3rWard0g/ATTACK-Python-Client
cd ATTACK-Python-Client
pip install .
Jupyter Notebooks - Code Integration
I created a few jupyter notebooks that I hope can help you get familiar with the library and allow you to implement it in your future projects.
Install Jupyter Lab and Pandas==0.22.0 in order to use the Jupyter Notebooks on your own. You can do it by using the requirements.txt file in this repo
pip install -r requirements.txt
Start Jupyter Lab by running the following commands in the root directory of the repo
cd notebooks
jupyter lab
Author
- Roberto Rodriguez @Cyb3rWard0g
Contributors
- Jose Luis Rodriguez @Cyb3rPandaH
Contributing
To-Do
- Revokation logic to update Groups Objects
- Integration with HELK
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for attackcti-0.1.3-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | 35fa88017bdd23ba24adc90552158a1ef561462f181db08c7cbae589829c4123 |
|
MD5 | d39cc7e8000d45971c12c61db9b6994a |
|
BLAKE2b-256 | e3549c0727b779f0ba9c90c7f220c5266ad17713ab83585b8f86f49a31e3811f |