feat(evaluations): enrich eval tests with attack path, criteria and data sources
- Capture Step.Description (HTML stripped), step name/number, substep ref, criteria, and data sources from MITRE ATT&CK Evaluations API - _aggregate_by_technique() now accumulates ALL occurrences per technique (multiple substep refs, criteria, step contexts) instead of keeping only the best-scoring one - New helper functions _build_procedure_text(), _build_description(), _build_red_summary() generate rich narratives from accumulated occurrences - New re_enrich_evaluation_round() service function + POST endpoint /system/attck-evaluations/re-enrich to update already-imported tests without changing detection results or validation state - Frontend: Re-enrich button per imported round + result banner in SystemPage
This commit is contained in:
@@ -109,6 +109,14 @@ export interface BulkApproveResult {
|
||||
message: string;
|
||||
}
|
||||
|
||||
export interface ReEnrichResult {
|
||||
updated: number;
|
||||
skipped: number;
|
||||
adversary: string;
|
||||
eval_round: number;
|
||||
message: string;
|
||||
}
|
||||
|
||||
/** Bulk-approve all in-review evaluation tests (Blue Team side). */
|
||||
export async function bulkApproveEvaluationTests(): Promise<BulkApproveResult> {
|
||||
const { data } = await client.post<BulkApproveResult>("/system/attck-evaluations/bulk-approve");
|
||||
@@ -120,3 +128,13 @@ export async function getEvalPendingCount(): Promise<{ pending: number }> {
|
||||
const { data } = await client.get<{ pending: number }>("/system/attck-evaluations/pending-count");
|
||||
return data;
|
||||
}
|
||||
|
||||
/** Re-enrich an already-imported round with attack path, criteria and data sources. */
|
||||
export async function reEnrichEvaluationRound(payload: {
|
||||
adversary_name: string;
|
||||
adversary_display: string;
|
||||
eval_round: number;
|
||||
}): Promise<ReEnrichResult> {
|
||||
const { data } = await client.post<ReEnrichResult>("/system/attck-evaluations/re-enrich", payload);
|
||||
return data;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user