rabobank-cdc/DeTTECT

Problem importing threat-actor-data at Editor

spookerlabs opened this issue · 1 comments

spookerlabs commented

I tried to import some samples from https://github.com/rabobank-cdc/DeTTECT/tree/master/threat-actor-data but only one seems working fine at the Editor is ASCS.

For example https://raw.githubusercontent.com/rabobank-cdc/DeTTECT/master/threat-actor-data/20200220-FireEye.yaml

image

ASCS works fine https://raw.githubusercontent.com/rabobank-cdc/DeTTECT/master/threat-actor-data/20200520-ASCS.yaml

image

Just updated to 1.3.1 and the same problem as 1.3.0. It seems like only parsing techniques in the same line and not multiline.

Thanks

marcusbakker commented

Hi Rodrigo,

The ACSC Group file has no weighted score as it only includes a list of techniques. However, the one from FireEye has weighted scores. The latter type of YAML Group file cannot, yet, be edited by the Editor. It's on the roadmap.

Regards,
Marcus

  • 👍1