kitos/Aegis
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
306 Commits 2 Branches 0 Tags
102370897fc29725985e7856fa656a5ff35901b5
Commit Graph

6 Commits

Author SHA1 Message Date
kitos 5f8a196df3 fix(evaluations): fix duplicate substeps and improve eval test format by scenario grouping
Aegis CI / lint-and-test (push) Has been cancelled
Details
2026-06-08 13:20:42 +02:00
kitos 7703c36ed7 feat(evaluations): enrich eval tests with attack path, criteria and data sources
Aegis CI / lint-and-test (push) Has been cancelled
Details 
- Capture Step.Description (HTML stripped), step name/number, substep ref,
  criteria, and data sources from MITRE ATT&CK Evaluations API
- _aggregate_by_technique() now accumulates ALL occurrences per technique
  (multiple substep refs, criteria, step contexts) instead of keeping only
  the best-scoring one
- New helper functions _build_procedure_text(), _build_description(),
  _build_red_summary() generate rich narratives from accumulated occurrences
- New re_enrich_evaluation_round() service function + POST endpoint
  /system/attck-evaluations/re-enrich to update already-imported tests
  without changing detection results or validation state
- Frontend: Re-enrich button per imported round + result banner in SystemPage

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-08 11:42:08 +02:00
kitos 93b4a700e6 fix(evaluations): results API returns list of vendors, not dict
Aegis CI / lint-and-test (push) Has been cancelled
Details 
The /api/results/ endpoint returns a LIST: [{name: crowdstrike, adversaries: [...]}]
Previous code called data.get() on the list → AttributeError crash on every import.

Fix: detect list vs dict response, extract the crowdstrike vendor entry first,
then get its adversaries list. Keeps legacy dict fallback just in case.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 16:42:27 +02:00
kitos cbaa0deedd fix(evaluations): correct fallback rounds + friendlier error messages
Aegis CI / lint-and-test (push) Has been cancelled
Details 
- Fallback names now use hyphens matching live API (carbanak-fin7, wizard-spider-sandworm)
- Add APT3 (R1) and Enterprise 2025/er7 (R7) to fallback - verified from live API
- Remove OilRig (R6) from fallback - CrowdStrike did not participate in Round 6
- Orange fallback banner only shows when NO rounds are available at all
- Soft gray note when rounds are loaded but API had transient error
- Check-new and import errors: detect 502/Cloudflare messages and show user-friendly text
  instead of raw Cloudflare HTML error messages

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 16:24:06 +02:00
kitos a4cdc06534 fix(evaluations): bypass Cloudflare 403 with browser headers + hardcoded fallback rounds
Aegis CI / lint-and-test (push) Has been cancelled
Details 
- Add browser User-Agent and Referer headers to all evals.mitre.org requests
- fetch_rounds_with_status() returns api_reachable flag + rounds list
- Fallback to 5 known public CrowdStrike rounds (APT29/R2 through OilRig/R6)
  when live API is blocked, so UI always shows something actionable
- Router returns {rounds, api_reachable, api_error} instead of plain array
- Frontend shows orange warning banner when using fallback data
- Remove 502 HTTPException - rounds are always returned (live or fallback)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 16:10:27 +02:00
kitos e3e79be35a feat(evaluations): ATT&CK Evaluations importer for CrowdStrike Falcon [FASE-6.1]
Aegis CI / lint-and-test (push) Has been cancelled
Details 
- Migration b048: evaluation_imports table (adversary, round, status, tests_created)
- EvaluationImport SQLAlchemy model
- attck_evaluations_service: fetch rounds from evals.mitre.org API, import per-technique
  detection results (Technique/Tactic/Telemetry -> detected/partially/not_detected)
- All imported tests land in in_review state with lab-environment disclaimer
- Idempotency guard prevents duplicate round imports
- 4 new endpoints: list rounds, import specific, import latest, check-new
- Weekly APScheduler cron (Mon 06:00) auto-checks and imports new rounds
- SystemPage UI: rounds table, import buttons, check-new, result feedback
- Disclaimer callout reminding admins these are lab results not org coverage

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 15:57:03 +02:00