"""MITRE ATT&CK reference tables. Read-mostly. Hard delete (no soft-delete) — replaced by the periodic sync job. A technique can map to multiple tactics (kill_chain_phases in STIX) hence the M2M `technique_tactics` join. Sub-techniques inherit their parent's tactics through the parent technique. """ from __future__ import annotations import uuid from sqlalchemy import ForeignKey, Index, String, Text, Uuid from sqlalchemy.orm import Mapped, mapped_column, relationship from app.db.base import Base from app.db.mixins import TimestampMixin, UuidPkMixin class MitreTactic(Base, UuidPkMixin, TimestampMixin): __tablename__ = "mitre_tactics" external_id: Mapped[str] = mapped_column(String(16), unique=True, nullable=False) short_name: Mapped[str] = mapped_column(String(80), nullable=False) name: Mapped[str] = mapped_column(String(120), nullable=False) description: Mapped[str | None] = mapped_column(Text, nullable=True) url: Mapped[str | None] = mapped_column(String(512), nullable=True) techniques: Mapped[list["MitreTechnique"]] = relationship( secondary="mitre_technique_tactics", back_populates="tactics", ) class MitreTechnique(Base, UuidPkMixin, TimestampMixin): __tablename__ = "mitre_techniques" external_id: Mapped[str] = mapped_column(String(16), unique=True, nullable=False) name: Mapped[str] = mapped_column(String(255), nullable=False) description: Mapped[str | None] = mapped_column(Text, nullable=True) url: Mapped[str | None] = mapped_column(String(512), nullable=True) tactics: Mapped[list[MitreTactic]] = relationship( secondary="mitre_technique_tactics", back_populates="techniques", lazy="selectin", ) subtechniques: Mapped[list["MitreSubtechnique"]] = relationship( back_populates="technique", cascade="all, delete-orphan", ) __table_args__ = (Index("ix_mitre_techniques_name", "name"),) class MitreSubtechnique(Base, UuidPkMixin, TimestampMixin): __tablename__ = "mitre_subtechniques" external_id: Mapped[str] = mapped_column(String(16), unique=True, nullable=False) name: Mapped[str] = mapped_column(String(255), nullable=False) description: Mapped[str | None] = mapped_column(Text, nullable=True) url: Mapped[str | None] = mapped_column(String(512), nullable=True) technique_id: Mapped[uuid.UUID] = mapped_column( Uuid(as_uuid=True), ForeignKey("mitre_techniques.id", ondelete="CASCADE"), nullable=False ) technique: Mapped[MitreTechnique] = relationship(back_populates="subtechniques") __table_args__ = (Index("ix_mitre_subtechniques_technique_id", "technique_id"),) class MitreTechniqueTactic(Base): """Many-to-many: a technique can serve several tactics (STIX kill_chain_phases).""" __tablename__ = "mitre_technique_tactics" technique_id: Mapped[uuid.UUID] = mapped_column( Uuid(as_uuid=True), ForeignKey("mitre_techniques.id", ondelete="CASCADE"), primary_key=True, ) tactic_id: Mapped[uuid.UUID] = mapped_column( Uuid(as_uuid=True), ForeignKey("mitre_tactics.id", ondelete="CASCADE"), primary_key=True, )