kitos
8bdbe48fbe
Blue Team gets a detect_procedure field on Test (what they actually did to detect the attack), Blue's counterpart to Red's procedure_text. It's seeded from a new detect_suggested_procedure field on TestTemplate at test-creation time, so a junior who later reuses the same template starts with prior guidance instead of a blank field. Also adds the procedure_suggestions review table and Test.source_template_id, laying the groundwork for suggesting template improvements from filled-in procedure fields (reviewed and approved by a lead, never auto-written). detect_procedure is archived (not cleared) on Blue reopen, matching blue_summary, and now appears in the Jira round-archived and blue_review comments alongside the existing detection/containment fields.
73 lines
3.7 KiB
Python
73 lines
3.7 KiB
Python
"""TestTemplate model — predefined test catalog entries."""
|
|
|
|
# Import uuid
|
|
import uuid
|
|
|
|
# Import Boolean, Column, DateTime, Index, String, Text,... from sqlalchemy
|
|
from sqlalchemy import Boolean, Column, DateTime, Index, String, Text, func
|
|
|
|
# Import UUID from sqlalchemy.dialects.postgresql
|
|
from sqlalchemy.dialects.postgresql import UUID
|
|
|
|
# Import Base from app.database
|
|
from app.database import Base
|
|
|
|
|
|
# Define class TestTemplate
|
|
class TestTemplate(Base):
|
|
"""Predefined test template mapped to a MITRE ATT&CK technique.
|
|
|
|
Templates come from several sources:
|
|
- **atomic_red_team**: Atomic Red Team by Red Canary
|
|
- **mitre**: MITRE ATT&CK procedure examples
|
|
- **custom**: Manually created by teams
|
|
|
|
Users can instantiate a real Test from a template.
|
|
"""
|
|
# Assign __tablename__ = "test_templates"
|
|
__tablename__ = "test_templates"
|
|
|
|
# Assign id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
|
|
id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
|
|
# Assign mitre_technique_id = Column(String, nullable=False) # e.g. "T1059.001"
|
|
mitre_technique_id = Column(String, nullable=False) # e.g. "T1059.001"
|
|
# Assign name = Column(String, nullable=False)
|
|
name = Column(String, nullable=False)
|
|
# Assign description = Column(Text, nullable=True)
|
|
description = Column(Text, nullable=True)
|
|
# Assign source = Column(String, nullable=False) # atomic_red_te...
|
|
source = Column(String, nullable=False) # atomic_red_team / mitre / custom
|
|
# Assign source_url = Column(String, nullable=True)
|
|
source_url = Column(String, nullable=True)
|
|
# Assign attack_procedure = Column(Text, nullable=True) # Suggested attack procedure
|
|
attack_procedure = Column(Text, nullable=True) # Suggested attack procedure
|
|
# Assign expected_detection = Column(Text, nullable=True) # What blue team should detect
|
|
expected_detection = Column(Text, nullable=True) # What blue team should detect
|
|
# Suggested detection procedure — Blue's counterpart to attack_procedure.
|
|
# Only ever filled in via an approved procedure suggestion or a lead
|
|
# editing the template directly; external syncs never touch it (those
|
|
# only insert brand-new rows, never update existing ones).
|
|
detect_suggested_procedure = Column(Text, nullable=True)
|
|
# Assign platform = Column(String, nullable=True) # windows / linux...
|
|
platform = Column(String, nullable=True) # windows / linux / macos
|
|
# Assign tool_suggested = Column(String, nullable=True)
|
|
tool_suggested = Column(String, nullable=True)
|
|
# Assign severity = Column(String, nullable=True) # low / medium / ...
|
|
severity = Column(String, nullable=True) # low / medium / high / critical
|
|
# Assign atomic_test_id = Column(String, nullable=True) # ID in Atomic Red Team...
|
|
atomic_test_id = Column(String, nullable=True) # ID in Atomic Red Team repo
|
|
# Assign suggested_remediation = Column(Text, nullable=True)
|
|
suggested_remediation = Column(Text, nullable=True)
|
|
# Assign is_active = Column(Boolean, default=True)
|
|
is_active = Column(Boolean, default=True)
|
|
# Assign created_at = Column(DateTime(timezone=True), server_default=func.now())
|
|
created_at = Column(DateTime(timezone=True), server_default=func.now())
|
|
|
|
# Assign __table_args__ = (
|
|
__table_args__ = (
|
|
Index('ix_test_templates_mitre_technique_id', 'mitre_technique_id'),
|
|
Index('ix_test_templates_source', 'source'),
|
|
Index('ix_test_templates_platform', 'platform'),
|
|
Index('ix_test_templates_severity', 'severity'),
|
|
)
|