Skip to content

Commit

Permalink
Deploy Resilient/resilient-community-apps to github.ibm.com/Resilient…
Browse files Browse the repository at this point in the history
…/resilient-community-apps.git:gh-pages
  • Loading branch information
traviscibot committed Nov 14, 2024
1 parent 433df99 commit 95de5e4
Show file tree
Hide file tree
Showing 5 changed files with 37 additions and 55 deletions.
Binary file modified .doctrees/environment.pickle
Binary file not shown.
Binary file modified .doctrees/fn_mitre_integration/README.doctree
Binary file not shown.
39 changes: 12 additions & 27 deletions _sources/fn_mitre_integration/README.md.txt
Original file line number Diff line number Diff line change
@@ -1,26 +1,5 @@
<!--
This README.md is generated by running:
"resilient-sdk docgen -p fn_mitre_integration"

This file was generated with resilient-sdk v51.0.0.1.486

It is best edited using a Text Editor with a Markdown Previewer. VS Code
is a good example. Checkout https://guides.github.com/features/mastering-markdown/
for tips on writing with Markdown

All fields followed by "::CHANGE_ME::"" should be manually edited

If you make manual edits and run docgen again, a .bak file will be created

Store any screenshots in the "doc/screenshots" directory and reference them like:
![screenshot: screenshot_1](./screenshots/screenshot_1.png)

NOTE: If your app is available in the container-format only, there is no need to mention the integration server in this readme.
-->

# MITRE ATT&CK


## Table of Contents
- [Release Notes](#release-notes)
- [Overview](#overview)
Expand Down Expand Up @@ -61,6 +40,11 @@
| 2.0.0 | 11/2019 | Customizations for group identification, software retrieval, MITRE collection support, and data format changes. |
| 2.0.1 | 04/2020 | Support added for App Host |
| 2.0.2 | 09/2020 | Added proxy support |
| 2.1.0 | 10/2024 | Added verify support |

### v2.1.0

When upgrading from a previous version to v2.1.0, manually update your app.config to use verify. The app.config changes are documented here [App Configuration](#app-configuration). The previous version of the app.config from versions before 2.1.0 are compatible with version 2.1.0+.

---

Expand All @@ -69,11 +53,11 @@
Provide a high-level description of the function itself and its remote software or application.
The text below is parsed from the "description" and "long_description" attributes in the setup.py file
-->
**Resilient Circuits Components for 'fn_mitre_integration'**
**IBM SOAR Components for 'fn_mitre_integration'**

MITRE’s TAXII<sup>TM</sup> 2.0 Server provides Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK or ATTACK) content.
This content is critical for cyber security industry in order to make a holistic approach to detection and mitigation of Advanced Persistent Threats (APTs).
MITRE Integration Function enables Resilient users to gather ATT&CK information on cyber intrusion once a
MITRE Integration Function enables SOAR users to gather ATT&CK information on cyber intrusion once a
tactic or technique has been identified. This information can help security analysts respond quickly to a (potential) breach.

### Key Features
Expand All @@ -98,13 +82,13 @@ This app supports the IBM Security QRadar SOAR Platform and the IBM Security QRa
The SOAR platform supports two app deployment mechanisms, Edge Gateway (also known as App Host) and integration server.

If deploying to a SOAR platform with an App Host, the requirements are:
* SOAR platform >= `32.3.12`.
* SOAR platform >= `51.0.0`.
* The app is in a container-based format (available from the AppExchange as a `zip` file).

If deploying to a SOAR platform with an integration server, the requirements are:
* SOAR platform >= `32.3.12`.
* SOAR platform >= `51.0.0`.
* The app is in the older integration format (available from the AppExchange as a `zip` file which contains a `tar.gz` file).
* Integration server is running `resilient_circuits>=32.0.0`.
* Integration server is running `resilient_circuits>=51.0.0`.
* If using an API key account, make sure the account provides the following minimum permissions:
| Name | Permissions |
| ---- | ----------- |
Expand Down Expand Up @@ -136,7 +120,7 @@ The app **does** support a proxy server.
### Python Environment
Python 3.6 and Python 3.9 are supported.
Additional package dependencies may exist for each of these packages:
* resilient_circuits>=32.0.0
* resilient_circuits>=51.0.0
* resilient_lib
* stix2
* taxii2-client>=2.0.0
Expand All @@ -148,6 +132,7 @@ List any steps that are needed to configure the endpoint to use this app.
| Config | Required | Example | Description |
| ------ | :------: | ------- | ----------- |
| **http_proxy** or **https_proxy** | No | https://proxyhost:8080 | *Optional settings for access to Mitre via a proxy.* |
| **verify** | No | True/False | *True or False or path to cert* |
---

## Installation
Expand Down
51 changes: 24 additions & 27 deletions fn_mitre_integration/README.html
Original file line number Diff line number Diff line change
Expand Up @@ -411,26 +411,7 @@
</label>
</div>
<article role="main" id="furo-main-content">
<!--
This README.md is generated by running:
"resilient-sdk docgen -p fn_mitre_integration"
This file was generated with resilient-sdk v51.0.0.1.486
It is best edited using a Text Editor with a Markdown Previewer. VS Code
is a good example. Checkout https://guides.github.com/features/mastering-markdown/
for tips on writing with Markdown
All fields followed by "::CHANGE_ME::"" should be manually edited
If you make manual edits and run docgen again, a .bak file will be created
Store any screenshots in the "doc/screenshots" directory and reference them like:
![screenshot: screenshot_1](./screenshots/screenshot_1.png)
NOTE: If your app is available in the container-format only, there is no need to mention the integration server in this readme.
-->
<section id="mitre-att-ck">
<section id="mitre-att-ck">
<h1>MITRE ATT&amp;CK<a class="headerlink" href="#mitre-att-ck" title="Link to this heading"></a></h1>
<section id="table-of-contents">
<h2>Table of Contents<a class="headerlink" href="#table-of-contents" title="Link to this heading"></a></h2>
Expand Down Expand Up @@ -509,9 +490,17 @@ <h2>Release Notes<a class="headerlink" href="#release-notes" title="Link to this
<td><p>09/2020</p></td>
<td><p>Added proxy support</p></td>
</tr>
<tr class="row-odd"><td><p>2.1.0</p></td>
<td><p>10/2024</p></td>
<td><p>Added verify support</p></td>
</tr>
</tbody>
</table>
</div>
<section id="v2-1-0">
<h3>v2.1.0<a class="headerlink" href="#v2-1-0" title="Link to this heading"></a></h3>
<p>When upgrading from a previous version to v2.1.0, manually update your app.config to use verify. The app.config changes are documented here <a class="reference internal" href="#app-configuration"><span class="xref myst">App Configuration</span></a>. The previous version of the app.config from versions before 2.1.0 are compatible with version 2.1.0+.</p>
</section>
</section>
<hr class="docutils" />
<section id="overview">
Expand All @@ -520,10 +509,10 @@ <h2>Overview<a class="headerlink" href="#overview" title="Link to this heading">
Provide a high-level description of the function itself and its remote software or application.
The text below is parsed from the "description" and "long_description" attributes in the setup.py file
-->
<p><strong>Resilient Circuits Components for ‘fn_mitre_integration’</strong></p>
<p><strong>IBM SOAR Components for ‘fn_mitre_integration’</strong></p>
<p>MITRE’s TAXII<sup>TM</sup> 2.0 Server provides Adversarial Tactics, Techniques, and Common Knowledge (ATT&amp;CK or ATTACK) content.
This content is critical for cyber security industry in order to make a holistic approach to detection and mitigation of Advanced Persistent Threats (APTs).
MITRE Integration Function enables Resilient users to gather ATT&amp;CK information on cyber intrusion once a
MITRE Integration Function enables SOAR users to gather ATT&amp;CK information on cyber intrusion once a
tactic or technique has been identified. This information can help security analysts respond quickly to a (potential) breach.</p>
<section id="key-features">
<h3>Key Features<a class="headerlink" href="#key-features" title="Link to this heading"></a></h3>
Expand All @@ -550,14 +539,14 @@ <h3>SOAR platform<a class="headerlink" href="#soar-platform" title="Link to this
<p>The SOAR platform supports two app deployment mechanisms, Edge Gateway (also known as App Host) and integration server.</p>
<p>If deploying to a SOAR platform with an App Host, the requirements are:</p>
<ul class="simple">
<li><p>SOAR platform &gt;= <code class="docutils literal notranslate"><span class="pre">32.3.12</span></code>.</p></li>
<li><p>SOAR platform &gt;= <code class="docutils literal notranslate"><span class="pre">51.0.0</span></code>.</p></li>
<li><p>The app is in a container-based format (available from the AppExchange as a <code class="docutils literal notranslate"><span class="pre">zip</span></code> file).</p></li>
</ul>
<p>If deploying to a SOAR platform with an integration server, the requirements are:</p>
<ul>
<li><p>SOAR platform &gt;= <code class="docutils literal notranslate"><span class="pre">32.3.12</span></code>.</p></li>
<li><p>SOAR platform &gt;= <code class="docutils literal notranslate"><span class="pre">51.0.0</span></code>.</p></li>
<li><p>The app is in the older integration format (available from the AppExchange as a <code class="docutils literal notranslate"><span class="pre">zip</span></code> file which contains a <code class="docutils literal notranslate"><span class="pre">tar.gz</span></code> file).</p></li>
<li><p>Integration server is running <code class="docutils literal notranslate"><span class="pre">resilient_circuits&gt;=32.0.0</span></code>.</p></li>
<li><p>Integration server is running <code class="docutils literal notranslate"><span class="pre">resilient_circuits&gt;=51.0.0</span></code>.</p></li>
<li><p>If using an API key account, make sure the account provides the following minimum permissions:</p>
<div class="table-wrapper colwidths-auto docutils container">
<table class="docutils align-default">
Expand Down Expand Up @@ -610,7 +599,7 @@ <h3>Python Environment<a class="headerlink" href="#python-environment" title="Li
<p>Python 3.6 and Python 3.9 are supported.
Additional package dependencies may exist for each of these packages:</p>
<ul class="simple">
<li><p>resilient_circuits&gt;=32.0.0</p></li>
<li><p>resilient_circuits&gt;=51.0.0</p></li>
<li><p>resilient_lib</p></li>
<li><p>stix2</p></li>
<li><p>taxii2-client&gt;=2.0.0</p></li>
Expand All @@ -635,6 +624,11 @@ <h4>Configuration<a class="headerlink" href="#configuration" title="Link to this
<td><p>https://proxyhost:8080</p></td>
<td><p><em>Optional settings for access to Mitre via a proxy.</em></p></td>
</tr>
<tr class="row-odd"><td><p><strong>verify</strong></p></td>
<td class="text-center"><p>No</p></td>
<td><p>True/False</p></td>
<td><p><em>True or False or path to cert</em></p></td>
</tr>
</tbody>
</table>
</div>
Expand Down Expand Up @@ -1652,7 +1646,10 @@ <h3>For Support<a class="headerlink" href="#for-support" title="Link to this hea
<ul>
<li><a class="reference internal" href="#">MITRE ATT&amp;CK</a><ul>
<li><a class="reference internal" href="#table-of-contents">Table of Contents</a></li>
<li><a class="reference internal" href="#release-notes">Release Notes</a></li>
<li><a class="reference internal" href="#release-notes">Release Notes</a><ul>
<li><a class="reference internal" href="#v2-1-0">v2.1.0</a></li>
</ul>
</li>
<li><a class="reference internal" href="#overview">Overview</a><ul>
<li><a class="reference internal" href="#key-features">Key Features</a></li>
</ul>
Expand Down
2 changes: 1 addition & 1 deletion searchindex.js

Large diffs are not rendered by default.

0 comments on commit 95de5e4

Please sign in to comment.