rabobank-cdc/DeTTECT

Request - YAML to CSV to YAML

Closed this issue · 1 comments

I'm loving the tool - I'm just wondering if you have a best practices (or script) that would effectively make it so that I can map my existing data source spreadsheet to your taxonomic structure.

User Story:
I have CSV of my detections, rules, controls that contribute to them, and classification but I need to map to the standard ATT&CK format. I need to be able to import that existing CSV or use an 'input-able' form which imports the data within the CSV, to the technique-administration file (or data-source-administration file) rather than going one by one (although there ARE benefits to doing this one by one).

Great to hear that you like the tool!

Unfortunately, we do not have a script for this. My approach would be to create this in Python (or any other language you prefer). Regarding Python, both YAML and CSV files are represented by a List of Dictionaries, which makes accessing and manipulating the data very easy. (In DeTT&CT we make use of the package ruamel.yaml to read and manipualte YAML. This package provides several advantages compared to PyYAML).

Possible approach:

  • Load the CSV or YAML into a List of Dictionaries.
  • Loop over the loaded data and transform it into the right format by applying your own logic.
  • Dump/write the file (CSV or YAML) to disk.