diff --git a/src/generator/index.ts b/src/generator/index.ts index e8bf1381..01c19a78 100644 --- a/src/generator/index.ts +++ b/src/generator/index.ts @@ -336,6 +336,12 @@ const minimalTechnique: MinimalTechnique = { external_id: 'T1234', }, ], + kill_chain_phases: [ + { + kill_chain_name: 'mitre-attack', + phase_name: 'execution', + }, + ], }; /** diff --git a/src/schemas/sdo/technique.schema.ts b/src/schemas/sdo/technique.schema.ts index dfea1bfb..e102c8ee 100644 --- a/src/schemas/sdo/technique.schema.ts +++ b/src/schemas/sdo/technique.schema.ts @@ -337,7 +337,7 @@ export const techniqueBaseSchema = attackBaseDomainObjectSchema // Optional in STIX but required in ATT&CK external_references: createAttackExternalReferencesSchema('attack-pattern'), - kill_chain_phases: z.array(killChainPhaseSchema).min(1).optional().meta({ + kill_chain_phases: z.array(killChainPhaseSchema).min(1).meta({ description: 'Techniques are associated with Tactics through their `kill_chain_phases` property. When the `kill_chain_name` matches the domain (`mitre-attack`, `mitre-mobile-attack`, or `mitre-ics-attack`), the `phase_name` corresponds to the `x_mitre_shortname` of the associated `x-mitre-tactic` object.', }), diff --git a/test/objects/stix-bundle.test.ts b/test/objects/stix-bundle.test.ts index d56bdaa9..2fd7972c 100644 --- a/test/objects/stix-bundle.test.ts +++ b/test/objects/stix-bundle.test.ts @@ -67,6 +67,7 @@ describe('StixBundleSchema', () => { x_mitre_version: '1.0', x_mitre_domains: ['enterprise-attack'], x_mitre_is_subtechnique: false, + kill_chain_phases: [{ kill_chain_name: 'mitre-attack', phase_name: 'execution' }], external_references: [ { source_name: 'mitre-attack', @@ -185,6 +186,7 @@ describe('StixBundleSchema', () => { x_mitre_version: '1.0', x_mitre_domains: ['enterprise-attack'], x_mitre_is_subtechnique: false, + kill_chain_phases: [{ kill_chain_name: 'mitre-attack', phase_name: 'execution' }], external_references: [ { source_name: 'mitre-attack', @@ -307,6 +309,7 @@ describe('StixBundleSchema', () => { x_mitre_version: '1.0', x_mitre_domains: ['enterprise-attack'], x_mitre_is_subtechnique: false, + kill_chain_phases: [{ kill_chain_name: 'mitre-attack', phase_name: 'execution' }], external_references: [ { source_name: 'mitre-attack', @@ -326,6 +329,7 @@ describe('StixBundleSchema', () => { x_mitre_version: '1.0', x_mitre_domains: ['enterprise-attack'], x_mitre_is_subtechnique: false, + kill_chain_phases: [{ kill_chain_name: 'mitre-attack', phase_name: 'execution' }], external_references: [ { source_name: 'mitre-attack', @@ -356,6 +360,7 @@ describe('StixBundleSchema', () => { x_mitre_version: '1.0', x_mitre_domains: ['enterprise-attack'], x_mitre_is_subtechnique: false, + kill_chain_phases: [{ kill_chain_name: 'mitre-attack', phase_name: 'execution' }], external_references: [ { source_name: 'mitre-attack', @@ -375,6 +380,7 @@ describe('StixBundleSchema', () => { x_mitre_version: '1.0', x_mitre_domains: ['enterprise-attack'], x_mitre_is_subtechnique: false, + kill_chain_phases: [{ kill_chain_name: 'mitre-attack', phase_name: 'execution' }], external_references: [ { source_name: 'mitre-attack', @@ -407,6 +413,7 @@ describe('StixBundleSchema', () => { x_mitre_version: '1.0', x_mitre_domains: ['enterprise-attack'], x_mitre_is_subtechnique: false, + kill_chain_phases: [{ kill_chain_name: 'mitre-attack', phase_name: 'execution' }], external_references: [ { source_name: 'mitre-attack', @@ -426,6 +433,7 @@ describe('StixBundleSchema', () => { x_mitre_version: '1.0', x_mitre_domains: ['enterprise-attack'], x_mitre_is_subtechnique: false, + kill_chain_phases: [{ kill_chain_name: 'mitre-attack', phase_name: 'execution' }], external_references: [ { source_name: 'mitre-attack', @@ -467,6 +475,7 @@ describe('StixBundleSchema', () => { x_mitre_version: '1.0', x_mitre_domains: ['enterprise-attack'], x_mitre_is_subtechnique: false, + kill_chain_phases: [{ kill_chain_name: 'mitre-attack', phase_name: 'execution' }], external_references: [ { source_name: 'mitre-attack', @@ -486,6 +495,7 @@ describe('StixBundleSchema', () => { x_mitre_version: '1.0', x_mitre_domains: ['enterprise-attack'], x_mitre_is_subtechnique: false, + kill_chain_phases: [{ kill_chain_name: 'mitre-attack', phase_name: 'execution' }], external_references: [ { source_name: 'mitre-attack', @@ -505,6 +515,7 @@ describe('StixBundleSchema', () => { x_mitre_version: '1.0', x_mitre_domains: ['enterprise-attack'], x_mitre_is_subtechnique: false, + kill_chain_phases: [{ kill_chain_name: 'mitre-attack', phase_name: 'execution' }], external_references: [ { source_name: 'mitre-attack', @@ -524,6 +535,7 @@ describe('StixBundleSchema', () => { x_mitre_version: '1.0', x_mitre_domains: ['enterprise-attack'], x_mitre_is_subtechnique: false, + kill_chain_phases: [{ kill_chain_name: 'mitre-attack', phase_name: 'execution' }], external_references: [ { source_name: 'mitre-attack', @@ -565,6 +577,7 @@ describe('StixBundleSchema', () => { x_mitre_version: '1.0', x_mitre_domains: ['enterprise-attack'], x_mitre_is_subtechnique: false, + kill_chain_phases: [{ kill_chain_name: 'mitre-attack', phase_name: 'execution' }], external_references: [ { source_name: 'mitre-attack', @@ -696,6 +709,7 @@ describe('StixBundleSchema', () => { x_mitre_version: '1.0', x_mitre_domains: ['enterprise-attack'], x_mitre_is_subtechnique: false, + kill_chain_phases: [{ kill_chain_name: 'mitre-attack', phase_name: 'execution' }], external_references: [ { source_name: 'mitre-attack', @@ -715,6 +729,7 @@ describe('StixBundleSchema', () => { x_mitre_version: '1.0', x_mitre_domains: ['enterprise-attack'], x_mitre_is_subtechnique: false, + kill_chain_phases: [{ kill_chain_name: 'mitre-attack', phase_name: 'execution' }], external_references: [ { source_name: 'mitre-attack', diff --git a/test/objects/technique.test.ts b/test/objects/technique.test.ts index fe5a0610..2a6e77a4 100644 --- a/test/objects/technique.test.ts +++ b/test/objects/technique.test.ts @@ -76,15 +76,15 @@ describe('TechniqueSchema', () => { testField('x_mitre_domains', 'invalid-domains'); }); + describe('kill_chain_phases', () => { + testField('kill_chain_phases', [{ invalid: 'object' }]); + }); + // Testing optional fields describe('description', () => { testField('description', 123, false); }); - describe('kill_chain_phases', () => { - testField('kill_chain_phases', [{ invalid: 'object' }], false); - }); - describe('x_mitre_platforms', () => { testField('x_mitre_platforms', 123, false); });