kitos
8bdbe48fbe
Blue Team gets a detect_procedure field on Test (what they actually did to detect the attack), Blue's counterpart to Red's procedure_text. It's seeded from a new detect_suggested_procedure field on TestTemplate at test-creation time, so a junior who later reuses the same template starts with prior guidance instead of a blank field. Also adds the procedure_suggestions review table and Test.source_template_id, laying the groundwork for suggesting template improvements from filled-in procedure fields (reviewed and approved by a lead, never auto-written). detect_procedure is archived (not cleared) on Blue reopen, matching blue_summary, and now appears in the Jira round-archived and blue_review comments alongside the existing detection/containment fields.
94 lines
4.3 KiB
Python
94 lines
4.3 KiB
Python
"""SQLAlchemy ORM model definitions for all database tables."""
|
|
# Import all models here so Alembic can detect them
|
|
from app.models.audit import AuditLog
|
|
from app.models.notification import Notification
|
|
from app.models.data_source import DataSource
|
|
from app.models.detection_rule import DetectionRule
|
|
from app.models.threat_actor import ThreatActor, ThreatActorTechnique
|
|
from app.models.defensive_technique import DefensiveTechnique, DefensiveTechniqueMapping
|
|
from app.models.test_template_detection_rule import TestTemplateDetectionRule
|
|
from app.models.test_detection_result import TestDetectionResult
|
|
from app.models.campaign import Campaign, CampaignTest, CampaignModificationRequest
|
|
from app.models.compliance import ComplianceFramework, ComplianceControl, ComplianceControlMapping
|
|
from app.models.coverage_snapshot import CoverageSnapshot, SnapshotTechniqueState
|
|
from app.models.jira_link import JiraLink, JiraLinkEntityType, JiraSyncDirection
|
|
from app.models.worklog import Worklog
|
|
from app.models.osint_item import OsintItem
|
|
from app.models.scoring_config import ScoringConfig
|
|
from app.models.enums import TechniqueStatus, TestState, TestResult, TeamSide
|
|
from app.models.webhook_config import WebhookConfig
|
|
from app.models.system_config import SystemConfig
|
|
from app.models.detection_lifecycle import (
|
|
DetectionAsset, DetectionTechniqueMapping, DetectionValidation,
|
|
TechniqueConfidenceScore, InfrastructureChangeLog,
|
|
DetectionConfidence, DetectionHealthStatus, InvalidationReason,
|
|
)
|
|
from app.models.decay_policy import DecayPolicy
|
|
from app.models.ownership_queue import (
|
|
TechniqueOwnership, RevalidationQueueItem,
|
|
QueuePriority, QueueStatus, QueueReason,
|
|
)
|
|
from app.models.attack_path import (
|
|
AttackPath, AttackPathStep, AttackPathExecution,
|
|
AttackPathStepResult, TimelineEntry,
|
|
ExecutionStatus, StepResultStatus, TimelineActorSide, TimelineEntryType,
|
|
)
|
|
from app.models.knowledge import Playbook, PlaybookVersion, LessonLearned
|
|
from app.models.risk_intelligence import TechniqueRiskProfile
|
|
from app.models.executive_dashboard import PostureSnapshot
|
|
from app.models.api_key import ApiKey
|
|
from app.models.sso_config import SsoConfig
|
|
from app.models.operational_alert import AlertRule, AlertInstance
|
|
from app.models.evidence import Evidence
|
|
from app.models.intel import IntelItem
|
|
from app.models.technique import Technique
|
|
from app.models.test import Test
|
|
from app.models.test_round_history import TestRoundHistory
|
|
from app.models.test_template import TestTemplate
|
|
from app.models.procedure_suggestion import ProcedureSuggestion
|
|
from app.models.user import User
|
|
|
|
# Assign __all__ = [
|
|
__all__ = [
|
|
# Literal argument value
|
|
"User", "Technique", "Test", "TestTemplate", "Evidence",
|
|
# Literal argument value
|
|
"IntelItem", "AuditLog", "Notification", "DataSource",
|
|
# Literal argument value
|
|
"DetectionRule", "ThreatActor", "ThreatActorTechnique",
|
|
# Literal argument value
|
|
"DefensiveTechnique", "DefensiveTechniqueMapping",
|
|
# Literal argument value
|
|
"TestTemplateDetectionRule", "TestDetectionResult",
|
|
# Literal argument value
|
|
"Campaign", "CampaignTest", "CampaignModificationRequest",
|
|
# Literal argument value
|
|
"ComplianceFramework", "ComplianceControl", "ComplianceControlMapping",
|
|
# Literal argument value
|
|
"CoverageSnapshot", "SnapshotTechniqueState",
|
|
# Literal argument value
|
|
"JiraLink", "JiraLinkEntityType", "JiraSyncDirection",
|
|
# Literal argument value
|
|
"Worklog", "OsintItem", "ScoringConfig",
|
|
# Literal argument value
|
|
"TechniqueStatus", "TestState", "TestResult", "TeamSide",
|
|
"WebhookConfig", "SystemConfig",
|
|
"DetectionAsset", "DetectionTechniqueMapping", "DetectionValidation",
|
|
"TechniqueConfidenceScore", "InfrastructureChangeLog",
|
|
"DetectionConfidence", "DetectionHealthStatus", "InvalidationReason", "DecayPolicy",
|
|
"TechniqueOwnership", "RevalidationQueueItem",
|
|
"QueuePriority", "QueueStatus", "QueueReason",
|
|
"AttackPath", "AttackPathStep", "AttackPathExecution",
|
|
"AttackPathStepResult", "TimelineEntry",
|
|
"ExecutionStatus", "StepResultStatus", "TimelineActorSide", "TimelineEntryType",
|
|
"Playbook", "PlaybookVersion", "LessonLearned",
|
|
"TechniqueRiskProfile",
|
|
"PostureSnapshot",
|
|
"ApiKey",
|
|
"SsoConfig",
|
|
"AlertRule",
|
|
"AlertInstance",
|
|
"TestRoundHistory",
|
|
"ProcedureSuggestion",
|
|
]
|