87 lines
3.1 KiB
Python
87 lines
3.1 KiB
Python
|
"""MITRE ATT&CK reference tables.
|
||
|
|
|
||
|
|
Read-mostly. Hard delete (no soft-delete) — replaced by the periodic sync job.
|
||
|
|
A technique can map to multiple tactics (kill_chain_phases in STIX) hence the
|
||
|
|
M2M `technique_tactics` join. Sub-techniques inherit their parent's tactics
|
||
|
|
through the parent technique.
|
||
|
|
"""
|
||
|
|
|
||
|
|
from __future__ import annotations
|
||
|
|
|
||
|
|
import uuid
|
||
|
|
|
||
|
|
from sqlalchemy import ForeignKey, Index, String, Text, Uuid
|
||
|
|
from sqlalchemy.orm import Mapped, mapped_column, relationship
|
||
|
|
|
||
|
|
from app.db.base import Base
|
||
|
|
from app.db.mixins import TimestampMixin, UuidPkMixin
|
||
|
|
|
||
|
|
|
||
|
|
class MitreTactic(Base, UuidPkMixin, TimestampMixin):
|
||
|
|
__tablename__ = "mitre_tactics"
|
||
|
|
|
||
|
|
external_id: Mapped[str] = mapped_column(String(16), unique=True, nullable=False)
|
||
|
|
short_name: Mapped[str] = mapped_column(String(80), nullable=False)
|
||
|
|
name: Mapped[str] = mapped_column(String(120), nullable=False)
|
||
|
|
description: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||
|
|
url: Mapped[str | None] = mapped_column(String(512), nullable=True)
|
||
|
|
|
||
|
|
techniques: Mapped[list["MitreTechnique"]] = relationship(
|
||
|
|
secondary="mitre_technique_tactics",
|
||
|
|
back_populates="tactics",
|
||
|
|
)
|
||
|
|
|
||
|
|
|
||
|
|
class MitreTechnique(Base, UuidPkMixin, TimestampMixin):
|
||
|
|
__tablename__ = "mitre_techniques"
|
||
|
|
|
||
|
|
external_id: Mapped[str] = mapped_column(String(16), unique=True, nullable=False)
|
||
|
|
name: Mapped[str] = mapped_column(String(255), nullable=False)
|
||
|
|
description: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||
|
|
url: Mapped[str | None] = mapped_column(String(512), nullable=True)
|
||
|
|
|
||
|
|
tactics: Mapped[list[MitreTactic]] = relationship(
|
||
|
|
secondary="mitre_technique_tactics",
|
||
|
|
back_populates="techniques",
|
||
|
|
lazy="selectin",
|
||
|
|
)
|
||
|
|
subtechniques: Mapped[list["MitreSubtechnique"]] = relationship(
|
||
|
|
back_populates="technique",
|
||
|
|
cascade="all, delete-orphan",
|
||
|
|
)
|
||
|
|
|
||
|
|
__table_args__ = (Index("ix_mitre_techniques_name", "name"),)
|
||
|
|
|
||
|
|
|
||
|
|
class MitreSubtechnique(Base, UuidPkMixin, TimestampMixin):
|
||
|
|
__tablename__ = "mitre_subtechniques"
|
||
|
|
|
||
|
|
external_id: Mapped[str] = mapped_column(String(16), unique=True, nullable=False)
|
||
|
|
name: Mapped[str] = mapped_column(String(255), nullable=False)
|
||
|
|
description: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||
|
|
url: Mapped[str | None] = mapped_column(String(512), nullable=True)
|
||
|
|
technique_id: Mapped[uuid.UUID] = mapped_column(
|
||
|
|
Uuid(as_uuid=True), ForeignKey("mitre_techniques.id", ondelete="CASCADE"), nullable=False
|
||
|
|
)
|
||
|
|
|
||
|
|
technique: Mapped[MitreTechnique] = relationship(back_populates="subtechniques")
|
||
|
|
|
||
|
|
__table_args__ = (Index("ix_mitre_subtechniques_technique_id", "technique_id"),)
|
||
|
|
|
||
|
|
|
||
|
|
class MitreTechniqueTactic(Base):
|
||
|
|
"""Many-to-many: a technique can serve several tactics (STIX kill_chain_phases)."""
|
||
|
|
|
||
|
|
__tablename__ = "mitre_technique_tactics"
|
||
|
|
|
||
|
|
technique_id: Mapped[uuid.UUID] = mapped_column(
|
||
|
|
Uuid(as_uuid=True),
|
||
|
|
ForeignKey("mitre_techniques.id", ondelete="CASCADE"),
|
||
|
|
primary_key=True,
|
||
|
|
)
|
||
|
|
tactic_id: Mapped[uuid.UUID] = mapped_column(
|
||
|
|
Uuid(as_uuid=True),
|
||
|
|
ForeignKey("mitre_tactics.id", ondelete="CASCADE"),
|
||
|
|
primary_key=True,
|
||
|
|
)
|