@mitre-attack/attack-data-model/dist/classes/attack-data-model.cjs

A TypeScript API for the MITRE ATT&CK data model

"use strict";
var __defProp = Object.defineProperty;
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
var __getOwnPropNames = Object.getOwnPropertyNames;
var __hasOwnProp = Object.prototype.hasOwnProperty;
var __export = (target, all) => {
  for (var name in all)
    __defProp(target, name, { get: all[name], enumerable: true });
};
var __copyProps = (to, from, except, desc) => {
  if (from && typeof from === "object" || typeof from === "function") {
    for (let key of __getOwnPropNames(from))
      if (!__hasOwnProp.call(to, key) && key !== except)
        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
  }
  return to;
};
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

// src/classes/attack-data-model.ts
var attack_data_model_exports = {};
__export(attack_data_model_exports, {
  AttackDataModel: () => AttackDataModel
});
module.exports = __toCommonJS(attack_data_model_exports);

// src/classes/common/attack-object.impl.ts
var AttackBaseImpl = class {
  /**
   * Sets the object that revokes the current object.
   * @param obj - The object that revokes this object.
   */
  setRevokedBy(obj) {
    this.revokedBy = obj;
  }
  /**
   * Returns the object that revoked this object.
   */
  getRevokedBy() {
    return this.revokedBy;
  }
};

// src/classes/sdo/asset.impl.ts
var AssetImpl = class extends AttackBaseImpl {
  constructor(asset) {
    super();
    this.asset = asset;
    // Custom properties prefixed with `_` to avoid conflicts
    this._techniques = [];
    Object.assign(this, asset);
  }
  addTechnique(technique) {
    this._techniques.push(technique);
  }
  // Custom method or property
  getDisplayName() {
    return `${this.asset.name} - Asset`;
  }
};

// src/classes/sdo/tactic.impl.ts
var TacticImpl = class extends AttackBaseImpl {
  constructor(tactic) {
    super();
    this.tactic = tactic;
    Object.assign(this, tactic);
  }
};

// src/classes/sdo/mitigation.impl.ts
var MitigationImpl = class extends AttackBaseImpl {
  constructor(mitigation) {
    super();
    this.mitigation = mitigation;
    Object.assign(this, mitigation);
  }
};

// src/classes/sdo/log-source.impl.ts
var LogSourceImpl = class extends AttackBaseImpl {
  constructor(logSource) {
    super();
    this.logSource = logSource;
    this._dataComponents = [];
    Object.assign(this, logSource);
  }
  addFoundBy(dataComponent) {
    this._dataComponents.push(dataComponent);
  }
};

// src/classes/sdo/data-component.impl.ts
var DataComponentImpl = class extends AttackBaseImpl {
  constructor(dataComponent) {
    super();
    this.dataComponent = dataComponent;
    this._detectedTechniques = [];
    this._logSources = [];
    Object.assign(this, dataComponent);
  }
  // Add a technique detected by this data component
  addDetectedTechnique(technique) {
    this._detectedTechniques.push(technique);
  }
  addFoundIn(logSource) {
    this._logSources.push(logSource);
  }
  // Getters
  getDetectedTechniques() {
    return this._detectedTechniques;
  }
  getLogSources() {
    return this._logSources;
  }
  get foundIn() {
    return this._logSources;
  }
};

// src/classes/sdo/technique.impl.ts
var TechniqueImpl2 = class extends AttackBaseImpl {
  constructor(technique) {
    super();
    this.technique = technique;
    this._subTechniques = [];
    this._tactics = [];
    this._mitigations = [];
    this._logSources = [];
    this._relatedTechniques = [];
    this._targetAssets = [];
    this._detectingDataComponents = [];
    Object.assign(this, technique);
  }
  setParent(parent) {
    this._parentTechnique = parent;
  }
  addSubTechnique(subTechnique) {
    this._subTechniques.push(subTechnique);
  }
  addTactic(tactic) {
    this._tactics.push(tactic);
  }
  addMitigation(mitigation) {
    this._mitigations.push(mitigation);
  }
  addLogSource(logSource) {
    this._logSources.push(logSource);
  }
  addRelatedTechnique(technique) {
    this._relatedTechniques.push(technique);
  }
  addTargetAsset(asset) {
    this._targetAssets.push(asset);
  }
  addDetectingDataComponent(dataComponent) {
    this._detectingDataComponents.push(dataComponent);
  }
  // Getters
  getSubTechniques() {
    return this._subTechniques;
  }
  getTactics() {
    return this._tactics;
  }
  getMitigations() {
    return this._mitigations;
  }
  getLogSources() {
    return this._logSources;
  }
  getParentTechnique() {
    return this._parentTechnique;
  }
  getRelatedTechniques() {
    return this._relatedTechniques;
  }
  getTargetAssets() {
    return this._targetAssets;
  }
  getDetectingDataComponents() {
    return this._detectingDataComponents;
  }
};

// src/classes/sdo/malware.impl.ts
var MalwareImpl = class extends AttackBaseImpl {
  constructor(malware) {
    super();
    this.malware = malware;
    this._techniques = [];
    Object.assign(this, malware);
  }
  // Add a technique used by the malware
  addTechnique(technique) {
    this._techniques.push(technique);
  }
  // Getters
  getTechniques() {
    return this._techniques;
  }
};

// src/classes/sdo/tool.impl.ts
var ToolImpl = class extends AttackBaseImpl {
  constructor(tool) {
    super();
    this.tool = tool;
    this._techniques = [];
    Object.assign(this, tool);
  }
  // Add a technique used by the tool
  addTechnique(technique) {
    this._techniques.push(technique);
  }
  // Getters
  getTechniques() {
    return this._techniques;
  }
};

// src/classes/sdo/group.impl.ts
var GroupImpl = class extends AttackBaseImpl {
  constructor(group) {
    super();
    this.group = group;
    this._techniques = [];
    this._software = [];
    this._attributedCampaigns = [];
    Object.assign(this, group);
  }
  // Add a technique used by the group
  addTechnique(technique) {
    this._techniques.push(technique);
  }
  // Add software used by the group
  addSoftware(software) {
    this._software.push(software);
  }
  addAttributedCampaign(campaign) {
    this._attributedCampaigns.push(campaign);
  }
  // Getters
  getTechniques() {
    return this._techniques;
  }
  getSoftware() {
    return this._software;
  }
  getAttributedCampaigns() {
    return this._attributedCampaigns;
  }
};

// src/classes/sdo/campaign.impl.ts
var CampaignImpl2 = class extends AttackBaseImpl {
  constructor(campaign) {
    super();
    this.campaign = campaign;
    this._techniques = [];
    this._software = [];
    Object.assign(this, campaign);
  }
  // Add a technique used by the campaign
  addTechnique(technique) {
    this._techniques.push(technique);
  }
  // Add software used by the campaign
  addSoftware(software) {
    this._software.push(software);
  }
  // Set the group this campaign is attributed to
  setAttributedTo(group) {
    this._attributedTo = group;
  }
  // Getters
  getTechniques() {
    return this._techniques;
  }
  getSoftware() {
    return this._software;
  }
  getAttributedTo() {
    return this._attributedTo;
  }
};

// src/classes/sdo/collection.impl.ts
var CollectionImpl = class extends AttackBaseImpl {
  constructor(collection) {
    super();
    this.collection = collection;
    Object.assign(this, collection);
  }
};

// src/classes/sdo/data-source.impl.ts
var DataSourceImpl = class extends AttackBaseImpl {
  constructor(dataSource) {
    super();
    this.dataSource = dataSource;
    Object.assign(this, dataSource);
  }
};

// src/classes/sdo/identity.impl.ts
var IdentityImpl = class extends AttackBaseImpl {
  constructor(identity) {
    super();
    this.identity = identity;
    Object.assign(this, identity);
  }
};

// src/classes/sdo/matrix.impl.ts
var MatrixImpl = class extends AttackBaseImpl {
  constructor(matrix) {
    super();
    this.matrix = matrix;
    Object.assign(this, matrix);
  }
};

// src/classes/smo/marking-definition.impl.ts
var MarkingDefinitionImpl = class extends AttackBaseImpl {
  constructor(markingDefinition) {
    super();
    this.markingDefinition = markingDefinition;
    Object.assign(this, markingDefinition);
  }
};

// src/classes/sro/relationship.impl.ts
var RelationshipImpl = class extends AttackBaseImpl {
  constructor(relationship) {
    super();
    this.relationship = relationship;
    Object.assign(this, relationship);
  }
};

// src/classes/sdo/detection-strategy.impl.ts
var DetectionStrategyImpl = class extends AttackBaseImpl {
  constructor(detectionStrategy) {
    super();
    this.detectionStrategy = detectionStrategy;
    this._techniques = [];
    Object.assign(this, detectionStrategy);
  }
  // Add a technique used by the group
  addTechnique(technique) {
    this._techniques.push(technique);
  }
  // Getters
  getTechniques() {
    return this._techniques;
  }
  get detects() {
    return this._techniques;
  }
};

// src/classes/sdo/analytic.impl.ts
var AnalyticImpl = class extends AttackBaseImpl {
  constructor(analytic) {
    super();
    this.analytic = analytic;
    Object.assign(this, analytic);
  }
};

// src/classes/attack-data-model.ts
var AttackDataModel = class {
  constructor(uuid, attackObjects) {
    this.uuid = uuid;
    this.attackObjects = attackObjects;
    this.techniques = [];
    this.campaigns = [];
    this.mitigations = [];
    this.identities = [];
    this.groups = [];
    this.malware = [];
    this.tools = [];
    this.markingDefinitions = [];
    this.dataComponents = [];
    this.dataSources = [];
    this.tactics = [];
    this.assets = [];
    this.matrices = [];
    this.collections = [];
    this.relationships = [];
    this.logSources = [];
    this.detectionStrategies = [];
    this.analytics = [];
    this.populateData();
  }
  /**
   * Returns the unique identifier for this data source/model.
   * @returns string - Returns the unique identifier for this data source/model
   */
  getUuid() {
    return this.uuid;
  }
  /**
   * Returns a list of ATT&CK objects that have been parsed by Zod schemas. These objects are not TS classes, but are plain JS objects. They do not contain relationship mappings.
   * @returns AttackObject[] - a list of ATT&CK objects that have been parsed by Zod schemas. These objects are not TS classes, but are plain JS objects. They do not contain relationship mappings.
   */
  getAttackObjects() {
    return this.attackObjects;
  }
  /**
   * Populates the class properties (e.g., techniques, groups, etc.) from the parsed objects array.
   */
  populateData() {
    const objectMap = /* @__PURE__ */ new Map();
    this.attackObjects.forEach((object) => {
      switch (object.type) {
        // ASSET
        case "x-mitre-asset": {
          const asset = new AssetImpl(object);
          this.assets.push(asset);
          objectMap.set(object.id, asset);
          break;
        }
        // CAMPAIGN
        case "campaign": {
          const campaign = new CampaignImpl2(object);
          this.campaigns.push(campaign);
          objectMap.set(object.id, campaign);
          break;
        }
        // COLLECTION
        case "x-mitre-collection": {
          const collection = new CollectionImpl(object);
          this.collections.push(collection);
          objectMap.set(object.id, collection);
          break;
        }
        // DATA COMPONENT
        case "x-mitre-data-component": {
          const dataComponent = new DataComponentImpl(object);
          this.dataComponents.push(dataComponent);
          objectMap.set(object.id, dataComponent);
          break;
        }
        // DATA SOURCE
        case "x-mitre-data-source": {
          const dataSource = new DataSourceImpl(object);
          this.dataSources.push(dataSource);
          objectMap.set(object.id, dataSource);
          break;
        }
        // GROUP
        case "intrusion-set": {
          const group = new GroupImpl(object);
          this.groups.push(group);
          objectMap.set(object.id, group);
          break;
        }
        // IDENTITY
        case "identity": {
          const identity = new IdentityImpl(object);
          this.identities.push(identity);
          objectMap.set(object.id, identity);
          break;
        }
        // MALWARE
        case "malware": {
          const malware = new MalwareImpl(object);
          this.malware.push(malware);
          objectMap.set(object.id, malware);
          break;
        }
        // MATRIX
        case "x-mitre-matrix": {
          const matrix = new MatrixImpl(object);
          this.matrices.push(matrix);
          objectMap.set(object.id, matrix);
          break;
        }
        // MITIGATION
        case "course-of-action": {
          const mitigation = new MitigationImpl(object);
          this.mitigations.push(mitigation);
          objectMap.set(object.id, mitigation);
          break;
        }
        // TACTIC
        case "x-mitre-tactic": {
          const tactic = new TacticImpl(object);
          this.tactics.push(tactic);
          objectMap.set(object.id, tactic);
          break;
        }
        // TECHNIQUE
        case "attack-pattern": {
          const technique = new TechniqueImpl2(object);
          this.techniques.push(technique);
          objectMap.set(object.id, technique);
          break;
        }
        // TOOL
        case "tool": {
          const tool = new ToolImpl(object);
          this.tools.push(tool);
          objectMap.set(object.id, tool);
          break;
        }
        // MARKING DEFINITION
        case "marking-definition": {
          const markingDefinition = new MarkingDefinitionImpl(object);
          this.markingDefinitions.push(markingDefinition);
          objectMap.set(object.id, markingDefinition);
          break;
        }
        // RELATIONSHIP
        case "relationship": {
          const relationship = new RelationshipImpl(object);
          this.relationships.push(relationship);
          objectMap.set(object.id, relationship);
          break;
        }
        // LOG SOURCE
        case "x-mitre-log-source": {
          const logSource = new LogSourceImpl(object);
          this.logSources.push(logSource);
          objectMap.set(object.id, logSource);
          break;
        }
        // DETECTION STRATEGY
        case "x-mitre-detection-strategy": {
          const detectionStrategy = new DetectionStrategyImpl(object);
          this.detectionStrategies.push(detectionStrategy);
          objectMap.set(object.id, detectionStrategy);
          break;
        }
        // ANALYTIC
        case "x-mitre-analytic": {
          const analytic = new AnalyticImpl(object);
          this.analytics.push(analytic);
          objectMap.set(object.id, analytic);
          break;
        }
      }
    });
    this.initializeRelationships(objectMap);
  }
  /**
   * Initializes relationships between objects, such as sub-techniques, tactics, mitigations, and more.
   */
  initializeRelationships(objectMap) {
    this.relationships.forEach((relationship) => {
      const sourceObj = objectMap.get(relationship.source_ref);
      const targetObj = objectMap.get(relationship.target_ref);
      if (sourceObj && targetObj) {
        switch (relationship.relationship_type) {
          case "subtechnique-of":
            if (sourceObj instanceof TechniqueImpl2 && targetObj instanceof TechniqueImpl2) {
              sourceObj.setParent(targetObj);
              targetObj.addSubTechnique(sourceObj);
            }
            break;
          case "uses":
            if (sourceObj instanceof GroupImpl && targetObj instanceof TechniqueImpl2) {
              sourceObj.addTechnique(targetObj);
            } else if (sourceObj instanceof CampaignImpl2 && targetObj instanceof TechniqueImpl2) {
              sourceObj.addTechnique(targetObj);
            } else if (sourceObj instanceof MalwareImpl && targetObj instanceof TechniqueImpl2) {
              sourceObj.addTechnique(targetObj);
            } else if (sourceObj instanceof ToolImpl && targetObj instanceof TechniqueImpl2) {
              sourceObj.addTechnique(targetObj);
            } else if (sourceObj instanceof GroupImpl && (targetObj instanceof MalwareImpl || targetObj instanceof ToolImpl)) {
              sourceObj.addSoftware(targetObj);
            } else if (sourceObj instanceof CampaignImpl2 && (targetObj instanceof MalwareImpl || targetObj instanceof ToolImpl)) {
              sourceObj.addSoftware(targetObj);
            }
            break;
          case "mitigates":
            if (sourceObj instanceof MitigationImpl && targetObj instanceof TechniqueImpl2) {
              targetObj.addMitigation(sourceObj);
            }
            break;
          case "detects":
            if (sourceObj instanceof DataComponentImpl && targetObj instanceof TechniqueImpl2) {
              sourceObj.addDetectedTechnique(targetObj);
              targetObj.addDetectingDataComponent(sourceObj);
            }
            break;
          case "targets":
            if (sourceObj instanceof TechniqueImpl2 && targetObj instanceof AssetImpl) {
              sourceObj.addTargetAsset(targetObj);
            }
            break;
          case "attributed-to":
            if (sourceObj instanceof CampaignImpl2 && targetObj instanceof GroupImpl) {
              sourceObj.setAttributedTo(targetObj);
              targetObj.addAttributedCampaign(sourceObj);
            }
            break;
          case "revoked-by":
            if (sourceObj.constructor.name === targetObj.constructor.name) {
              sourceObj.setRevokedBy(targetObj);
            }
            break;
          case "found-in":
            if (sourceObj instanceof DataComponentImpl && targetObj instanceof LogSourceImpl) {
              sourceObj.addFoundIn(targetObj);
              targetObj.addFoundBy(sourceObj);
            }
            break;
          default:
            break;
        }
      }
    });
  }
  // Other methods to query objects, get by ID, etc. (unchanged from previous version)
};
// Annotate the CommonJS export names for ESM import in node:
0 && (module.exports = {
  AttackDataModel
});