Techniques being annotated even when a selected data source not part of the yaml
roboticsea opened this issue · 8 comments
Hey there!
Thanks so much for this tool! Really helps me prioritize detections to build.
Maybe I'm doing something wrong, but if I select a data source, for example network connection creation, techniques that do not have that as an available data source are still being annotated by, I believe "applicable to".
If it's a bug in the newest version, I thought I'd submit an issue. If this is user error, I'm really sorry!
-Rob
hi @roboticsea
We don't quite understand what you mean. Can you please elaborate your issue a bit more and include some screenshots?
Could you share some screenshots?
What you are seeing in the Navigator is correct. For example, the metadata shown for T1200 tells you you're missing a data source to have visibility. Hence the score of 0%.
About the yellow underlying, those can be pretty annoying. We currently have no way of influencing that from the .json layer file. However, one solution is to use a different URL for the ATT&CK Navigator, which removes the yellow underlying for annotated techniques.
https://mitre-attack.github.io/attack-navigator/#comment_underline=false
Good to hear that. I will close this issue for now.