@mitre-attack/attack-data-model
Version:
A TypeScript API for the MITRE ATT&CK data model
326 lines (320 loc) • 13.4 kB
JavaScript
;
var __defProp = Object.defineProperty;
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
var __getOwnPropNames = Object.getOwnPropertyNames;
var __hasOwnProp = Object.prototype.hasOwnProperty;
var __export = (target, all) => {
for (var name in all)
__defProp(target, name, { get: all[name], enumerable: true });
};
var __copyProps = (to, from, except, desc) => {
if (from && typeof from === "object" || typeof from === "function") {
for (let key of __getOwnPropNames(from))
if (!__hasOwnProp.call(to, key) && key !== except)
__defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
}
return to;
};
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
// src/schemas/common/common-properties.ts
var common_properties_exports = {};
__export(common_properties_exports, {
aliasesSchema: () => aliasesSchema,
attackDomainSchema: () => attackDomainSchema,
createOldMitreAttackIdSchema: () => createOldMitreAttackIdSchema,
descriptionSchema: () => descriptionSchema,
killChainNameSchema: () => killChainNameSchema,
killChainPhaseSchema: () => killChainPhaseSchema,
nameSchema: () => nameSchema,
objectMarkingRefsSchema: () => objectMarkingRefsSchema,
versionSchema: () => versionSchema,
xMitreAttackSpecVersionSchema: () => xMitreAttackSpecVersionSchema,
xMitreContributorsSchema: () => xMitreContributorsSchema,
xMitreDeprecatedSchema: () => xMitreDeprecatedSchema,
xMitreDomainsSchema: () => xMitreDomainsSchema,
xMitreIdentity: () => xMitreIdentity,
xMitreIdentitySchema: () => xMitreIdentitySchema,
xMitreModifiedByRefSchema: () => xMitreModifiedByRefSchema,
xMitreOldAttackIdSchema: () => xMitreOldAttackIdSchema,
xMitrePlatformSchema: () => xMitrePlatformSchema,
xMitrePlatformsSchema: () => xMitrePlatformsSchema,
xMitreVersionSchema: () => xMitreVersionSchema
});
module.exports = __toCommonJS(common_properties_exports);
var import_v43 = require("zod/v4");
// src/schemas/common/stix-identifier.ts
var import_v42 = require("zod/v4");
// src/schemas/common/stix-type.ts
var import_v4 = require("zod/v4");
var stixTypeToTypeName = {
"attack-pattern": "Technique",
bundle: "StixBundle",
campaign: "Campaign",
"course-of-action": "Mitigation",
"extension-definition": null,
identity: "Identity",
"intrusion-set": "Group",
malware: "Malware",
tool: "Tool",
"marking-definition": "MarkingDefinition",
"x-mitre-analytic": "Analytic",
"x-mitre-data-component": "DataComponent",
"x-mitre-detection-strategy": "DetectionStrategy",
"x-mitre-data-source": "DataSource",
"x-mitre-log-source": "LogSource",
"x-mitre-tactic": "Tactic",
"x-mitre-asset": "Asset",
"x-mitre-matrix": "Matrix",
"x-mitre-collection": "Collection",
relationship: "Relationship",
file: "",
// not used in ATT&CK but used in sample_refs for Malware
artifact: ""
// not used in ATT&CK but used in sample_refs for Malware
// 'observed-data': 'ObservedData', // not used in ATT&CK
// 'report': 'Report', // not used in ATT&CK
// 'threat-actor': 'ThreatActor', // not used in ATT&CK
// 'vulnerability': 'Vulnerability', // not used in ATT&CK
};
var supportedStixTypes = [
"attack-pattern",
"bundle",
"campaign",
"course-of-action",
"extension-definition",
"identity",
"intrusion-set",
"malware",
"tool",
"marking-definition",
"x-mitre-analytic",
"x-mitre-data-component",
"x-mitre-detection-strategy",
"x-mitre-tactic",
"x-mitre-asset",
"x-mitre-data-source",
"x-mitre-log-source",
"x-mitre-matrix",
"x-mitre-collection",
"relationship",
"file",
// not used in ATT&CK but used in sample_refs for Malware
"artifact"
// not used in ATT&CK but used in sample_refs for Malware
// "indicator", // not used in ATT&CK
// "observed-data", // not used in ATT&CK
// "report", // not used in ATT&CK
// "threat-actor", // not used in ATT&CK
// "vulnerability", // not used in ATT&CK
];
var stixTypeSchema = import_v4.z.enum(supportedStixTypes, {
error: (issue) => {
if (issue.code === "invalid_value") {
const received = typeof issue.input === "string" ? issue.input : String(issue.input);
return `Invalid STIX type '${received}'. Expected one of the supported STIX types.`;
}
return void 0;
}
}).meta({
description: "The type property identifies the type of STIX Object (SDO, Relationship Object, etc). The value of the type field MUST be one of the types defined by a STIX Object (e.g., indicator)."
});
// src/schemas/common/stix-identifier.ts
var stixIdentifierSchema = import_v42.z.string().refine((val) => val.includes("--") && val.split("--").length === 2, {
error: (issue) => ({
code: "custom",
message: "Invalid STIX Identifier: must comply with format 'type--UUIDv4'",
input: issue.input,
path: []
})
}).refine(
(val) => {
const [type] = val.split("--");
return stixTypeSchema.safeParse(type).success;
},
{
error: (issue) => {
const val = issue.input;
const [type] = val.split("--");
const typeName = type in stixTypeToTypeName ? stixTypeToTypeName[type] : "STIX";
return {
code: "custom",
message: `Invalid STIX Identifier for ${typeName} object: contains invalid STIX type '${type}'`,
input: issue.input,
path: []
};
}
}
).refine(
(val) => {
const [, uuid] = val.split("--");
return import_v42.z.uuid().safeParse(uuid).success;
},
{
error: (issue) => {
const val = issue.input;
const [type] = val.split("--");
const typeName = type in stixTypeToTypeName ? stixTypeToTypeName[type] : "STIX";
return {
code: "custom",
message: `Invalid STIX Identifier for ${typeName} object: contains invalid UUIDv4 format`,
input: issue.input,
path: []
};
}
}
).meta({
description: "Represents identifiers across the CTI specifications. The format consists of the name of the top-level object being identified, followed by two dashes (--), followed by a UUIDv4."
});
// src/schemas/common/common-properties.ts
var versionSchema = import_v43.z.string().regex(/^\d+\.\d+$/, "Version must be in the format 'major.minor'").default("2.1").meta({
description: "Represents the version of the object in a 'major.minor' format, where both 'major' and 'minor' are integers. This versioning follows semantic versioning principles but excludes the patch number. The version number is incremented by ATT&CK when the content of the object is updated. This property does not apply to relationship objects."
});
var nameSchema = import_v43.z.string().min(1, "Name must not be empty").meta({ description: "The name of the object." });
var descriptionSchema = import_v43.z.string().meta({ description: "A description of the object." });
var aliasesSchema = import_v43.z.array(import_v43.z.string(), { error: "Aliases must be an array of strings." }).meta({
description: "Alternative names used to identify this object. The first alias must match the object's name."
});
var xMitreVersionSchema = import_v43.z.string().regex(/^(\d{1,2})\.(\d{1,2})$/, "Version must be in format 'M.N' where M and N are 0-99").meta({
description: "Represents the version of the object in a 'major.minor' format, where both 'major' and 'minor' are integers between 0 and 99. This versioning follows semantic versioning principles but excludes the patch number. The version number is incremented by ATT&CK when the content of the object is updated. This property does not apply to relationship objects."
});
var semverRegex = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
var xMitreAttackSpecVersionSchema = import_v43.z.string().regex(semverRegex, "Must be valid semantic version (MAJOR.MINOR.PATCH)").meta({
description: "The version of the ATT&CK spec used by the object. This field helps consuming software determine if the data format is supported. If the field is not present on an object, the spec version will be assumed to be 2.0.0. Refer to the ATT&CK CHANGELOG for all supported versions."
});
var oldAttackIdRegex = /^MOB-(M|S)\d{4}$/;
function createOldMitreAttackIdSchema(stixType) {
const baseSchema = import_v43.z.string().meta({ description: "Old ATT&CK IDs that may have been associated with this object" });
switch (stixType) {
case "malware":
case "tool":
return baseSchema.refine(
(value) => {
return /^MOB-S\d{4}$/.test(value);
},
{
message: `x_mitre_old_attack_id for ${stixType} need to be in the format MOB-S####`
}
);
case "course-of-action":
return baseSchema.refine(
(value) => {
return /^MOB-M\d{4}$/.test(value);
},
{
message: `x_mitre_old_attack_id for ${stixType} need to be in the format MOB-M####`
}
);
default:
throw new Error(`Unsupported STIX type: ${stixType}`);
}
}
var xMitreOldAttackIdSchema = import_v43.z.string().refine(
(value) => {
return oldAttackIdRegex.test(value);
},
{
message: "Must be in the format 'MOB-X0000' where X is either 'M' or 'S', followed by exactly four digits"
}
).meta({ description: "Old ATT&CK IDs that may have been associated with this object" });
var attackDomainSchema = import_v43.z.enum(["enterprise-attack", "mobile-attack", "ics-attack"]);
var xMitreDomainsSchema = import_v43.z.array(attackDomainSchema).min(1, {
message: "At least one MITRE ATT&CK domain must be specified."
}).meta({ description: "The technology domains to which the ATT&CK object belongs." });
var xMitreDeprecatedSchema = import_v43.z.boolean({
error: "x_mitre_deprecated must be a boolean."
}).meta({ description: "Indicates whether the object has been deprecated." });
var supportedMitrePlatforms = [
"Field Controller/RTU/PLC/IED",
"Network Devices",
"Data Historian",
"Google Workspace",
"Office Suite",
"ESXi",
"Identity Provider",
"Containers",
"Azure AD",
"Engineering Workstation",
"Control Server",
"Human-Machine Interface",
"Windows",
"Linux",
"IaaS",
"None",
"iOS",
"PRE",
"SaaS",
"Input/Output Server",
"macOS",
"Android",
"Safety Instrumented System/Protection Relay",
"Embedded"
];
var xMitrePlatformSchema = import_v43.z.enum(supportedMitrePlatforms, {
error: () => `Platform must be one of: ${supportedMitrePlatforms.join(", ")}`
});
var xMitrePlatformsSchema = import_v43.z.array(xMitrePlatformSchema, {
error: (issue) => issue.code === "invalid_type" ? "x_mitre_platforms must be an array of strings" : "Invalid platforms array"
}).min(1, "At least one platform is required").refine((items) => new Set(items).size === items.length, {
message: "Platforms must be unique (no duplicates allowed)."
}).meta({ description: "List of platforms that apply to the object." });
var objectMarkingRefsSchema = import_v43.z.array(
stixIdentifierSchema.startsWith(
"marking-definition--",
'Identifier must start with "marking-definition--"'
)
).meta({
description: "The list of marking-definition objects to be applied to this object."
});
var xMitreContributorsSchema = import_v43.z.array(import_v43.z.string().nonempty()).meta({
description: "People and organizations who have contributed to the object. Not found on objects of type `relationship`."
}).nonempty();
var xMitreIdentity = "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5";
var xMitreIdentitySchema = import_v43.z.literal(xMitreIdentity);
var xMitreModifiedByRefSchema = xMitreIdentitySchema.meta({
description: "The STIX ID of the MITRE identity object. Used to track the identity of the MITRE organization, which created the current version of the object. Previous versions of the object may have been created by other individuals or organizations."
});
var killChainNameSchema = import_v43.z.enum([
"mitre-attack",
"mitre-mobile-attack",
"mitre-ics-attack"
]);
var killChainPhaseSchema = import_v43.z.object({
phase_name: import_v43.z.string({
error: (issue) => issue.input === void 0 ? "Phase name is required" : "Phase name must be a string"
}).refine(
(value) => {
const isLowercase = value === value.toLowerCase();
const usesHyphens = !value.includes(" ") && !value.includes("_");
return isLowercase && usesHyphens;
},
{
message: "Phase name should be all lowercase and use hyphens instead of spaces or underscores."
}
).meta({
description: "The name of the phase in the kill chain. The value of this property SHOULD be all lowercase and SHOULD use hyphens instead of spaces or underscores as word separators."
}),
kill_chain_name: killChainNameSchema
}).strict();
// Annotate the CommonJS export names for ESM import in node:
0 && (module.exports = {
aliasesSchema,
attackDomainSchema,
createOldMitreAttackIdSchema,
descriptionSchema,
killChainNameSchema,
killChainPhaseSchema,
nameSchema,
objectMarkingRefsSchema,
versionSchema,
xMitreAttackSpecVersionSchema,
xMitreContributorsSchema,
xMitreDeprecatedSchema,
xMitreDomainsSchema,
xMitreIdentity,
xMitreIdentitySchema,
xMitreModifiedByRefSchema,
xMitreOldAttackIdSchema,
xMitrePlatformSchema,
xMitrePlatformsSchema,
xMitreVersionSchema
});