e3e79be35a
Some checks failed
Aegis CI / lint-and-test (push) Has been cancelled
- Migration b048: evaluation_imports table (adversary, round, status, tests_created) - EvaluationImport SQLAlchemy model - attck_evaluations_service: fetch rounds from evals.mitre.org API, import per-technique detection results (Technique/Tactic/Telemetry -> detected/partially/not_detected) - All imported tests land in in_review state with lab-environment disclaimer - Idempotency guard prevents duplicate round imports - 4 new endpoints: list rounds, import specific, import latest, check-new - Weekly APScheduler cron (Mon 06:00) auto-checks and imports new rounds - SystemPage UI: rounds table, import buttons, check-new, result feedback - Disclaimer callout reminding admins these are lab results not org coverage Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
99 lines
2.9 KiB
TypeScript
99 lines
2.9 KiB
TypeScript
import client from "./client";
|
|
|
|
export interface SyncMitreResponse {
|
|
message: string;
|
|
status?: string;
|
|
new?: number;
|
|
updated?: number;
|
|
}
|
|
|
|
export interface IntelScanResponse {
|
|
message: string;
|
|
new_items: number;
|
|
}
|
|
|
|
export interface SchedulerJob {
|
|
id: string;
|
|
name: string;
|
|
next_run_time: string | null;
|
|
}
|
|
|
|
export interface SchedulerStatusResponse {
|
|
running: boolean;
|
|
jobs: SchedulerJob[];
|
|
}
|
|
|
|
/** Manually trigger MITRE ATT&CK sync. */
|
|
export async function triggerMitreSync(): Promise<SyncMitreResponse> {
|
|
const { data } = await client.post<SyncMitreResponse>("/system/sync-mitre");
|
|
return data;
|
|
}
|
|
|
|
/** Manually trigger threat intelligence scan. */
|
|
export async function triggerIntelScan(): Promise<IntelScanResponse> {
|
|
const { data } = await client.post<IntelScanResponse>("/system/run-intel-scan");
|
|
return data;
|
|
}
|
|
|
|
/** Get scheduler status. */
|
|
export async function getSchedulerStatus(): Promise<SchedulerStatusResponse> {
|
|
const { data } = await client.get<SchedulerStatusResponse>("/system/scheduler-status");
|
|
return data;
|
|
}
|
|
|
|
// ── ATT&CK Evaluations ─────────────────────────────────────────────
|
|
|
|
export interface EvaluationRound {
|
|
name: string;
|
|
display_name: string;
|
|
eval_round: number;
|
|
imported: boolean;
|
|
imported_at: string | null;
|
|
tests_created: number | null;
|
|
techniques_covered: number | null;
|
|
}
|
|
|
|
export interface EvaluationImportResult {
|
|
message: string;
|
|
created: number;
|
|
skipped: number;
|
|
techniques_covered: number;
|
|
adversary: string;
|
|
eval_round: number;
|
|
}
|
|
|
|
export interface NewRoundCheckResult {
|
|
new_round_available: boolean;
|
|
already_imported: boolean;
|
|
latest_round: { name: string; display_name: string; eval_round: number } | null;
|
|
error?: string;
|
|
}
|
|
|
|
/** List all public CrowdStrike evaluation rounds with import status. */
|
|
export async function listEvaluationRounds(): Promise<EvaluationRound[]> {
|
|
const { data } = await client.get<EvaluationRound[]>("/system/attck-evaluations/rounds");
|
|
return data;
|
|
}
|
|
|
|
/** Import a specific evaluation round. */
|
|
export async function importEvaluationRound(payload: {
|
|
adversary_name: string;
|
|
adversary_display: string;
|
|
eval_round: number;
|
|
}): Promise<EvaluationImportResult> {
|
|
const { data } = await client.post<EvaluationImportResult>("/system/attck-evaluations/import", payload);
|
|
return data;
|
|
}
|
|
|
|
/** Import the latest available round automatically. */
|
|
export async function importLatestEvaluation(): Promise<EvaluationImportResult> {
|
|
const { data } = await client.post<EvaluationImportResult>("/system/attck-evaluations/import-latest");
|
|
return data;
|
|
}
|
|
|
|
/** Check if a new round is available. */
|
|
export async function checkNewEvaluationRound(): Promise<NewRoundCheckResult> {
|
|
const { data } = await client.get<NewRoundCheckResult>("/system/attck-evaluations/check-new");
|
|
return data;
|
|
}
|