Attack Pattern

Details

ID	`Attack Pattern`
From Version	6.2.0
To Version	6.9.9
Format Script	ExtractAttackPattern
Layout	Attack Pattern

Detection Regex

\bT\d{4}(?:\.\d{3})?\b

Manual Mapping (8)

Indicator Field	Source Path
`description`	AttackPattern.Description
`firstseenbysource`	AttackPattern.FirstSeenBySource
`killchainphases`	AttackPattern.KillChainPhases
`mitreid`	AttackPattern.MITREID
`operatingsystemrefs`	AttackPattern.OperatingSystemRefs
`publications`	AttackPattern.Publications
`stixid`	AttackPattern.STIXID
`tags`	AttackPattern.Tags

Source

reputation-Attack_Pattern.json reputation-Attack_PatternV2.json

Download History Raw

{
    "contextPath": "",
    "contextValue": "",
    "defaultMapping": null,
    "details": "Attack Pattern",
    "legacyNames": ["STIX Attack Pattern"],
    "disabled": false,
    "enhancementScriptNames": [],
    "excludedBrands": [],
    "expiration": 0,
    "file": false,
    "fileHashesPriority": null,
    "formatScript": "ExtractAttackPattern",
    "id": "Attack Pattern",
    "locked": false,
    "manualMapping": {
        "description": {
            "simple": "AttackPattern.Description",
            "complex": null
        },
        "firstseenbysource": {
            "simple": "AttackPattern.FirstSeenBySource",
            "complex": null
        },
        "killchainphases": {
            "simple": "AttackPattern.KillChainPhases",
            "complex": null
        },
        "mitreid": {
            "simple": "AttackPattern.MITREID",
            "complex": null
        },
        "operatingsystemrefs": {
            "simple": "AttackPattern.OperatingSystemRefs",
            "complex": null
        },
        "publications": {
            "simple": "AttackPattern.Publications",
            "complex": null
        },
        "stixid": {
            "simple": "AttackPattern.STIXID",
            "complex": null
        },
        "tags": {
            "simple": "AttackPattern.Tags",
            "complex": null
        }
    },
    "mergeContext": false,
    "regex": "\\bT\\d{4}(?:\\.\\d{3})?\\b",
    "reputationCommand": "",
    "reputationScriptName": "",
    "sortValues": null,
    "system": false,
    "updateAfter": 0,
    "version": -1,
    "fromVersion": "6.2.0",
    "toVersion": "6.9.9",
    "layout": "STIX Attack Pattern"

}