MISP
/
MISP
mirror of https://github.com/MISP/MISP
2
2
Fork 0
Code Issues Releases Wiki Activity

new: [cluster] Display heatmap on the Att&ck Matrix for all tagged data. 

fix #4344
pull/4346/head
mokaddem 2019-03-20 14:28:08 +01:00
parent 09ae8a5364
commit 016893210d
5 changed files with 117 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
app/Controller/Component/ACLComponent.php
View File

@ -197,7 +197,8 @@ class ACLComponent extends Component
'delete' => array('perm_site_admin'),
'detach' => array('perm_tagger'),
'index' => array('*'),
'view' => array('*')
'view' => array('*'),
'viewGalaxyMatrix' => array('*')
),
'galaxyElements' => array(
'index' => array('*')

1
app/Controller/EventsController.php
View File

@ -4939,7 +4939,6 @@ class EventsController extends AppController
App::uses('ColourGradientTool', 'Tools');
$gradientTool = new ColourGradientTool();
$colours = $gradientTool->createGradientFromValues($scores);
$this->set('eventId', $eventId);
$this->set('target_type', $scope);
$this->set('columnOrders', $killChainOrders);

103
app/Controller/GalaxyClustersController.php
View File

@ -356,4 +356,107 @@ class GalaxyClustersController extends AppController
}
}
}
public function viewGalaxyMatrix($id) {
if (!$this->request->is('ajax')) {
throw new MethodNotAllowedException('This function can only be reached via AJAX.');
}
$cluster = $this->GalaxyCluster->find('first', array(
'conditions' => array('id' => $id)
));
if (empty($cluster)) {
throw new Exception("Invalid Galaxy Cluster.");
}
$this->loadModel('Event');
$mitreAttackGalaxyId = $this->GalaxyCluster->Galaxy->getMitreAttackGalaxyId();
$attackPatternTagNames = $this->GalaxyCluster->find('list', array(
'conditions' => array('galaxy_id' => $mitreAttackGalaxyId),
'fields' => array('tag_name')
));
$cluster = $cluster['GalaxyCluster'];
$tag_name = $cluster['tag_name'];
// fetch all attribute ids having the requested cluster
$attributeIds = $this->Event->Attribute->AttributeTag->find('list', array(
'contain' => array('Tag'),
'conditions' => array(
'Tag.name' => $tag_name
),
'fields' => array('attribute_id'),
'recursive' => -1
));
// fetch all related tags belonging to attack pattern
$attributeTags = $this->Event->Attribute->AttributeTag->find('all', array(
'contain' => array('Tag'),
'conditions' => array(
'attribute_id' => $attributeIds,
'Tag.name' => $attackPatternTagNames
),
'fields' => array('Tag.name, COUNT(DISTINCT event_id) as tag_count'),
'recursive' => -1,
'group' => array('Tag.name')
));
// fetch all event ids having the requested cluster
$eventIds = $this->Event->EventTag->find('list', array(
'contain' => array('Tag'),
'conditions' => array(
'Tag.name' => $tag_name
),
'fields' => array('event_id'),
'recursive' => -1
));
// fetch all related tags belonging to attack pattern
$eventTags = $this->Event->EventTag->find('all', array(
'contain' => array('Tag'),
'conditions' => array(
'event_id' => $eventIds,
'Tag.name' => $attackPatternTagNames
),
'fields' => array('Tag.name, COUNT(DISTINCT event_id) as tag_count'),
'recursive' => -1,
'group' => array('Tag.name')
));
$scores = array();
foreach ($attributeTags as $tag) {
$tagName = $tag['Tag']['name'];
$scores[$tagName] = intval($tag[0]['tag_count']);
}
foreach ($eventTags as $tag) {
$tagName = $tag['Tag']['name'];
if (isset($scores[$tagName])) {
$scores[$tagName] = $scores[$tagName] + intval($tag[0]['tag_count']);
} else {
$scores[$tagName] = intval($tag[0]['tag_count']);
}
}
$maxScore = count($scores) > 0 ? max(array_values($scores)) : 0;
$matrixData = $this->GalaxyCluster->Galaxy->getMatrix($mitreAttackGalaxyId);
$tabs = $matrixData['tabs'];
$matrixTags = $matrixData['matrixTags'];
$killChainOrders = $matrixData['killChain'];
$instanceUUID = $matrixData['instance-uuid'];
App::uses('ColourGradientTool', 'Tools');
$gradientTool = new ColourGradientTool();
$colours = $gradientTool->createGradientFromValues($scores);
$this->set('target_type', 'attribute');
$this->set('columnOrders', $killChainOrders);
$this->set('tabs', $tabs);
$this->set('scores', $scores);
$this->set('maxScore', $maxScore);
if (!empty($colours)) {
$this->set('colours', $colours['mapping']);
$this->set('interpolation', $colours['interpolation']);
}
$this->set('pickingMode', false);
$this->set('defaultTabName', 'mitre-attack');
$this->set('removeTrailling', 2);
$this->render('cluster_matrix');
}
}

6
app/View/GalaxyClusters/cluster_matrix.ctp Normal file
View File

@ -0,0 +1,6 @@
<button class="btn btn-inverse" onclick="$('#attackmatrix_div').toggle('blind', 300);"><span class="fa fa-eye-slash"> <?php echo __('Toggle ATT&CK Matrix'); ?></span></button>
<div id="attackmatrix_div" style="position: relative; border: solid 1px;" class="statistics_attack_matrix hidden">
<?php
echo $this->element('view_galaxy_matrix');
?>
</div>

6
app/View/GalaxyClusters/view.ctp
View File

@ -50,6 +50,9 @@
</dl>
</div>
</div>
<div class="row-fuild">
<div id="matrix_container"></div>
</div>
<div class="row-fluid">
<div id="elements_div" class="span8"></div>
</div>
@ -59,5 +62,8 @@ $(document).ready(function () {
$.get("/galaxy_elements/index/<?php echo $cluster['GalaxyCluster']['id']; ?>", function(data) {
$("#elements_div").html(data);
});
$.get("/galaxy_clusters/viewGalaxyMatrix/<?php echo $cluster['GalaxyCluster']['id']; ?>", function(data) {
$("#matrix_container").html(data);
});
});
</script>