MITRENameByID_Formatter

Get a MITRE ATT&CK object name by its ID. The script is using TIMs IOCs to find the correct name. (MITRE ATT&CK IOCs must exist in the Threat Intel data).

python · Common Scripts

Details

ID	`MITRENameByID_Formatter`
Language	python
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10404775`
Tags	indicator-format

README

Get a MITRE ATT&CK object name by its ID. The script is using TIMs IOCs to find the correct name. (MITRE ATT&CK IOCs must exist in the Threat Intel data).

Script Data

Name	Description
Script Type	python3
Tags	indicator-format

Dependencies

This script uses the following commands and scripts.

MITRE ATT&CK v2
mitre-get-indicator-name

Inputs

Argument Name	Description
input	The MITRE ATT&CK object ID.

Outputs

There are no outputs for this script.

Source

MITRENameByIDFormatter.py MITRENameByIDFormatter_test.py MITRENameByIDFormatter.yml

Download History Raw

from unittest.mock import patch

import demistomock as demisto  # noqa: F401
import MITRENameByIDFormatter
import pytest
from CommonServerPython import *  # noqa: F401
from MITRENameByIDFormatter import main


@pytest.mark.parametrize(
    "input, expected_response",
    [
        pytest.param("T1078", (True, ['{"value": "Valid Accounts", "mitreid": "T1078"}']), id="Valid MITRE technique ID"),
        pytest.param(
            "T1078.001",
            (True, ['{"value": "Valid Accounts: Default Accounts", "mitreid": "T1078.001"}']),
            id="Valid MITRE technique ID with sub-technique",
        ),
    ],
)
@patch.object(demisto, "args")
@patch.object(MITRENameByIDFormatter, "return_results")
@patch.object(MITRENameByIDFormatter, "execute_command")
def test_mitre_name_by_id_formatter(mock_execute_command, mock_return_results, mock_args, input, expected_response):
    mock_args.return_value = {"input": input}
    mock_execute_command.return_value = expected_response
    main()
    mock_return_results.assert_called_once()
    args, kwargs = mock_return_results.call_args
    assert args[0][0] == json.loads(expected_response[1][0])["value"] or ""


@patch.object(demisto, "args")
@patch.object(MITRENameByIDFormatter, "return_results")
@patch.object(MITRENameByIDFormatter, "execute_command")
def test_invalid_mitre_id(mock_execute_command, mock_return_results, mock_args):
    input = "T9999"
    expected_response = (True, [""])

    mock_args.return_value = {"input": input}
    mock_execute_command.return_value = expected_response
    main()
    mock_return_results.assert_called_once()
    args, kwargs = mock_return_results.call_args
    assert args[0][0] == ""