Repository navigation
P7b-2: map rules to ATT&CK and add graph-only adversary scenarios - #38
Merged
therandomsecurityguy merged 1 commit intoOct 27, 2026
Merged
Conversation
Final phase of the predictive security roadmap, under the agreed defaults (curated mapping table, graph-only emulation; live AWS execution stays out of scope). - attack-techniques.ts: a reviewed ATT&CK subset (16 techniques with names and tactics) and a per-rule mapping covering all 34 catalogue rules — the framework-citations pattern, pinned by a test that every rule is mapped, every technique is known, and ids are well-formed, so drift fails CI. Techniques ride on GET /rules and /rules/:id, on every issue's metadata (attackTechniques), and as an "ATT&CK techniques" card on the issue page. - attack-scenarios.ts: three curated chains of existing rules — leaked-credential-to-data, internet-to-admin, cicd-to-cloud-takeover — where each step names the rule that would be that step's evidence, plus stepResources() for the matched-path resources. Validated by the same pinning approach. - GET /attack-scenarios (Viewer, static) lists them with resolved techniques and rule names; GET /attack-scenarios/:id (Viewer + expensive-query limiter) is graph-only emulation: each step re-runs its rule's query against the live graph, deduped and capped at 200 paths with truncation flagged, reporting matched path counts, first resources, and the matched-step total. A failing step records its error and the rest still run; only an all-steps failure is a 500. No AWS call, nothing executed — attribution over collected evidence. - UI: the "Adversary scenarios" page under Inventory with per-scenario run results and the graph-only disclaimer; the issue page gains the ATT&CK techniques card. Why this is safe: read-only, bounded, and labelled — scenarios only run internal catalogue queries (ruleId from the catalogue, never caller Gremlin), the mapping is curated and pinned, and results claim no more than "these steps match your current findings".
3 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Final phase of the predictive security roadmap — P7b-2, under the agreed defaults (curated mapping table, graph-only emulation; live AWS execution stays explicitly out of scope). 23 files, +959/−2.
Curated ATT&CK mapping (
attack-techniques.ts)GET /rules//rules/:id, on every issue (metadata.attackTechniques), and as an "ATT&CK techniques" card on the issue pageGraph-only adversary scenarios (
attack-scenarios.ts)leaked-credential-to-data,internet-to-admin,cicd-to-cloud-takeover; each step names the rule that would be that step's evidenceGET /attack-scenarios(Viewer) lists them with resolved techniques + rule names;GET /attack-scenarios/:id(Viewer + expensive-query limiter) re-runs each step's rule query against the live graph — deduped, capped at 200 paths withtruncatedflagged — reporting per-step matched counts, first resources, errors (rest keep running; all-fail is a 500), and the matched-step totalWhy this is safe
ruleIdfrom the catalogue, never caller Gremlin), rate-limited as an expensive endpointTest plan
npx jest --runInBand— 19 projects / 1790 tests passed (new: mapping pins, scenario curation/resources, runner metadata, API list/run/dedupe/step-error/500, UI page + issue card)npm run typecheck; full workspace lint;npm run format:checknpm run ci:build;npm run package:lambdas && npm run smoke:lambdas