in parseRuleData.ts [63:116]
const convertHuntMitre = function (mitreData: string[]): Threat[] {
const threat: Threat[] = [];
mitreData.forEach((item) => {
if (item.startsWith('TA')) {
threat.push({
framework: "MITRE ATT&CK",
tactic: {
id: item,
name: "",
reference: `https://attack.mitre.org/tactics/${item}/`,
},
technique: [], // Ensure technique is an empty array if not present
});
} else if (item.startsWith('T')) {
const parts = item.split('.');
const techniqueId = parts[0];
const subtechniqueId = parts[1];
const technique: Technique = {
id: techniqueId,
name: "",
reference: `https://attack.mitre.org/techniques/${techniqueId}/`,
};
if (subtechniqueId) {
technique.subtechnique = [
{
id: `${techniqueId}.${subtechniqueId}`,
reference: `https://attack.mitre.org/techniques/${techniqueId}/${subtechniqueId}/`,
},
];
}
// Find the last added threat with a tactic to add the technique to it
const lastThreat = threat[threat.length - 1];
if (lastThreat && lastThreat.tactic && lastThreat.technique) {
lastThreat.technique.push(technique);
} else {
threat.push({
framework: "MITRE ATT&CK",
tactic: {
id: "",
name: "",
reference: "",
},
technique: [technique],
});
}
}
});
return threat;
};