080ce56de7
Some checks failed
Aegis CI / lint-and-test (push) Has been cancelled
Models (5 tables):
- AttackPath: named reusable attack scenario with template flag
- AttackPathStep: ordered kill-chain step (technique + test link)
- AttackPathExecution: a run with Red/Blue leads, timing, stored metrics
- AttackPathStepResult: per-step detected/not_detected/skipped result
- TimelineEntry: timestamped Red/Blue/system actions for MTTD/MTTR
Migration b036atk: raw SQL to avoid SQLAlchemy DDL hook issues
Service (attack_path_service.py):
- Full CRUD for paths + steps (add, update, delete, reorder)
- Execution lifecycle: create → start → execute steps → complete/abort
- Pre-creates pending step results on execution creation
- Auto-adds system timeline entries on key state transitions
- complete_execution() computes: detection_rate, mttd_seconds,
furthest_undetected_step, detected/not_detected/skipped counts
- get_kill_chain_metrics(): per-step breakdown + phase summary
Router /api/v1/attack-paths (20 endpoints):
POST/GET/PATCH/DELETE attack paths
GET/POST/PATCH/DELETE steps + reorder
POST/GET executions per path
GET/POST/start/complete/abort executions
POST/GET step results
POST/GET timeline entries
GET kill-chain metrics
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
63 lines
3.1 KiB
Python
63 lines
3.1 KiB
Python
# Import all models here so Alembic can detect them
|
|
from app.models.user import User
|
|
from app.models.technique import Technique
|
|
from app.models.test import Test
|
|
from app.models.test_template import TestTemplate
|
|
from app.models.evidence import Evidence
|
|
from app.models.intel import IntelItem
|
|
from app.models.audit import AuditLog
|
|
from app.models.notification import Notification
|
|
from app.models.data_source import DataSource
|
|
from app.models.detection_rule import DetectionRule
|
|
from app.models.threat_actor import ThreatActor, ThreatActorTechnique
|
|
from app.models.defensive_technique import DefensiveTechnique, DefensiveTechniqueMapping
|
|
from app.models.test_template_detection_rule import TestTemplateDetectionRule
|
|
from app.models.test_detection_result import TestDetectionResult
|
|
from app.models.campaign import Campaign, CampaignTest
|
|
from app.models.compliance import ComplianceFramework, ComplianceControl, ComplianceControlMapping
|
|
from app.models.coverage_snapshot import CoverageSnapshot, SnapshotTechniqueState
|
|
from app.models.jira_link import JiraLink, JiraLinkEntityType, JiraSyncDirection
|
|
from app.models.worklog import Worklog
|
|
from app.models.osint_item import OsintItem
|
|
from app.models.scoring_config import ScoringConfig
|
|
from app.models.enums import TechniqueStatus, TestState, TestResult, TeamSide
|
|
from app.models.webhook_config import WebhookConfig
|
|
from app.models.system_config import SystemConfig
|
|
from app.models.detection_lifecycle import (
|
|
DetectionAsset, DetectionTechniqueMapping, DetectionValidation,
|
|
TechniqueConfidenceScore, InfrastructureChangeLog,
|
|
DetectionConfidence, DetectionHealthStatus, InvalidationReason,
|
|
)
|
|
from app.models.decay_policy import DecayPolicy
|
|
from app.models.ownership_queue import (
|
|
TechniqueOwnership, RevalidationQueueItem,
|
|
QueuePriority, QueueStatus, QueueReason,
|
|
)
|
|
from app.models.attack_path import (
|
|
AttackPath, AttackPathStep, AttackPathExecution,
|
|
AttackPathStepResult, TimelineEntry,
|
|
ExecutionStatus, StepResultStatus, TimelineActorSide, TimelineEntryType,
|
|
)
|
|
|
|
__all__ = [
|
|
"User", "Technique", "Test", "TestTemplate", "Evidence",
|
|
"IntelItem", "AuditLog", "Notification", "DataSource",
|
|
"DetectionRule", "ThreatActor", "ThreatActorTechnique",
|
|
"DefensiveTechnique", "DefensiveTechniqueMapping",
|
|
"TestTemplateDetectionRule", "TestDetectionResult",
|
|
"Campaign", "CampaignTest",
|
|
"ComplianceFramework", "ComplianceControl", "ComplianceControlMapping",
|
|
"CoverageSnapshot", "SnapshotTechniqueState",
|
|
"JiraLink", "JiraLinkEntityType", "JiraSyncDirection",
|
|
"Worklog", "OsintItem", "ScoringConfig",
|
|
"TechniqueStatus", "TestState", "TestResult", "TeamSide",
|
|
"WebhookConfig", "SystemConfig",
|
|
"DetectionAsset", "DetectionTechniqueMapping", "DetectionValidation",
|
|
"TechniqueConfidenceScore", "InfrastructureChangeLog", "DecayPolicy",
|
|
"TechniqueOwnership", "RevalidationQueueItem",
|
|
"QueuePriority", "QueueStatus", "QueueReason",
|
|
"AttackPath", "AttackPathStep", "AttackPathExecution",
|
|
"AttackPathStepResult", "TimelineEntry",
|
|
"ExecutionStatus", "StepResultStatus", "TimelineActorSide", "TimelineEntryType",
|
|
]
|