1532 remove mitre attack config #1618

ilija-lazoroski · 2021-11-17T16:18:31Z

What does this PR do?

Fixes #1532 .

Add any further explanations here.

PR Checklist

Have you added an explanation of what your changes do and why you'd like to include them?
Is the TravisCI build passing?
Was the CHANGELOG.md updated to reflect the changes?
Was the documentation framework updated to reflect the changes?

Testing Checklist

~~Added relevant unit tests?~~
Have you successfully tested your changes locally? Elaborate:

Tested by {Running the Monkey locally with relevant config/running Island/...}
If applicable, add screenshots or log transcripts of the feature working

Explain Changes

codecov · 2021-11-17T16:25:44Z

Codecov Report

Merging #1618 (c7a1c9d) into develop (f3b7803) will increase coverage by 0.06%.
The diff coverage is 20.00%.

@@             Coverage Diff             @@
##           develop    #1618      +/-   ##
===========================================
+ Coverage    44.90%   44.96%   +0.06%     
===========================================
  Files          469      467       -2     
  Lines        13605    13496     -109     
===========================================
- Hits          6109     6069      -40     
+ Misses        7496     7427      -69

Impacted Files	Coverage Δ
monkey/common/utils/attack_utils.py	`100.00% <ø> (ø)`
monkey/monkey_island/cc/app.py	`79.38% <ø> (-0.31%)`	⬇️
.../monkey_island/cc/services/attack/attack_schema.py	`100.00% <ø> (ø)`
...land/cc/services/attack/technique_reports/T1003.py	`50.00% <ø> (ø)`
...land/cc/services/attack/technique_reports/T1016.py	`57.89% <ø> (ø)`
...land/cc/services/attack/technique_reports/T1018.py	`52.38% <ø> (ø)`
...land/cc/services/attack/technique_reports/T1021.py	`43.33% <ø> (ø)`
...land/cc/services/attack/technique_reports/T1041.py	`47.61% <ø> (ø)`
...land/cc/services/attack/technique_reports/T1059.py	`50.00% <ø> (ø)`
...land/cc/services/attack/technique_reports/T1075.py	`46.15% <ø> (ø)`
... and 26 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update f3b7803...c7a1c9d. Read the comment docs.

VakarisZ · 2021-11-19T08:26:17Z

docs/content/usage/scenarios/custom-scenario/attack.md

@@ -13,12 +13,10 @@ The Infection Monkey can simulate various [ATT&CK](https://attack.mitre.org/matr

 ## Configuration

- **ATT&CK matrix** You can use the ATT&CK configuration section to select which techniques you want the Infection Monkey to simulate.
-For the full simulation, use the default settings.
+- **Monkey -> Post breach actions** Enable/Disable post breach action in order to trigger an ATT&CK technique on the network. E.g. Trap command triggers Trap ATT&CK technique.


Since we're moving away from assessment, maybe it's best to just remove the whole scenario? @mssalvatore

But the user really needs to know how the mitre attack techniques can be enabled even without the configuration attack screen.

Let's leave it for now. We're going to reimagine our relationship with MITRE ATT&CK, but removing this now is premature.

monkey/monkey_island/cc/services/attack/attack_config.py

VakarisZ

We need to further investigate swimm, I think some units reference it: .swm/afMu3y3ny5lnrYFWl3EI.swm:10

VakarisZ · 2021-11-19T08:59:39Z

We need to change comment in monkey/monkey_island/cc/app.py:96

VakarisZ

The whole monkey/monkey_island/cc/services/attack/attack_config.py needs to go

mssalvatore · 2021-11-19T12:01:07Z

The whole monkey/monkey_island/cc/services/attack/attack_config.py needs to go

@VakarisZ The attack report relies on some functions in attack_config.py. The goal of this issue is to remove the config screen from the frontend.

Some work needs to be done to improve the attack report to match the Monkey's clarified mission. When we do that work, the references to the attack config in the backend can be fixed. Until we plan updates to the attack report, I think trying to refactor the backend is wasted effort.

shreyamalviya

❤
Did you try running the agent and playing with the ATT&CK report? If nothing breaks, we have some logic for the ATT&CK report that would show a technique as disabled (light grey and striked out) if it was disabled from the ATT&CK config. I believe we can get rid of that logic too.

docs/content/usage/scenarios/custom-scenario/attack.md

shreyamalviya · 2021-11-19T13:18:22Z

Also, doesn't show a popup anymore if config changes are not submitted before changing the page, and they're all lost:

x.mp4

VakarisZ · 2021-11-22T10:35:33Z

The whole monkey/monkey_island/cc/services/attack/attack_config.py needs to go

@VakarisZ The attack report relies on some functions in attack_config.py. The goal of this issue is to remove the config screen from the frontend.

Some work needs to be done to improve the attack report to match the Monkey's clarified mission. When we do that work, the references to the attack config in the backend can be fixed. Until we plan updates to the attack report, I think trying to refactor the backend is wasted effort.

Attack report is no longer logically tied to attack config and the codebase should reflect it. I'm not sure how moving this task to a later date helps us. I'm not sure what changes you have in mind to the attack report, but I can't see any groundbreaking changes. And until then we're keeping some code that makes no sense in the codebase. @ilija-lazoroski I think you've made the right choice to remove attack_config.py

ilija-lazoroski requested review from mssalvatore, VakarisZ and shreyamalviya November 17, 2021 16:18

ilija-lazoroski marked this pull request as ready for review November 18, 2021 23:07

VakarisZ reviewed Nov 19, 2021

View reviewed changes

monkey/monkey_island/cc/services/attack/attack_config.py Outdated Show resolved Hide resolved

VakarisZ reviewed Nov 19, 2021

View reviewed changes

VakarisZ requested changes Nov 19, 2021

View reviewed changes

shreyamalviya requested changes Nov 19, 2021

View reviewed changes

docs/content/usage/scenarios/custom-scenario/attack.md Outdated Show resolved Hide resolved

ilija-lazoroski force-pushed the 1532-remove-mitre-attack-config branch from 2158e16 to b3e974b Compare November 19, 2021 17:10

ilija-lazoroski requested review from shreyamalviya and VakarisZ November 19, 2021 17:11

ilija-lazoroski force-pushed the 1532-remove-mitre-attack-config branch 2 times, most recently from 9f7c6f5 to 9e05125 Compare November 19, 2021 17:19

ilija-lazoroski added 2 commits November 19, 2021 18:19

UI: Remove ATT&CK Configuration

23d05c3

Island: Remove attack endpoint and config functions

ee16fa8

ilija-lazoroski force-pushed the 1532-remove-mitre-attack-config branch from 9e05125 to 3983ec2 Compare November 19, 2021 17:21

mssalvatore approved these changes Nov 19, 2021

View reviewed changes

ilija-lazoroski added 6 commits November 22, 2021 11:27

Docs: Remove MITRE attack scenario

0e4e137

Swimm: Remove explanation on attack techniques

5807220

Changelog: Add entry for removing ATT&CK configuration screen

a41cad6

Common: Remove disabled state from scan status

f07b7fa

Island: Remove attack config and enable all techniques by default

4e98baf

UT: Remove testing disabled attack techniques

c7a1c9d

ilija-lazoroski force-pushed the 1532-remove-mitre-attack-config branch from 3983ec2 to c7a1c9d Compare November 22, 2021 10:28

shreyamalviya approved these changes Nov 22, 2021

View reviewed changes

ilija-lazoroski merged commit 6cc983d into develop Nov 22, 2021

ilija-lazoroski deleted the 1532-remove-mitre-attack-config branch November 22, 2021 11:06

shreyamalviya mentioned this pull request Aug 25, 2022

Remove all code related to ScanStatus.DISABLED in UI #2214

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

1532 remove mitre attack config #1618

1532 remove mitre attack config #1618

Uh oh!

ilija-lazoroski commented Nov 17, 2021 •

edited

Loading

Uh oh!

codecov bot commented Nov 17, 2021 •

edited

Loading

Uh oh!

VakarisZ Nov 19, 2021

Uh oh!

ilija-lazoroski Nov 19, 2021

Uh oh!

mssalvatore Nov 19, 2021

Uh oh!

Uh oh!

VakarisZ left a comment

Uh oh!

VakarisZ commented Nov 19, 2021

Uh oh!

VakarisZ left a comment

Uh oh!

mssalvatore commented Nov 19, 2021

Uh oh!

shreyamalviya left a comment

Uh oh!

Uh oh!

shreyamalviya commented Nov 19, 2021

Uh oh!

VakarisZ commented Nov 22, 2021

Uh oh!

Uh oh!

1532 remove mitre attack config #1618

1532 remove mitre attack config #1618

Uh oh!

Conversation

ilija-lazoroski commented Nov 17, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

PR Checklist

Testing Checklist

Explain Changes

Uh oh!

codecov bot commented Nov 17, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

VakarisZ Nov 19, 2021

Choose a reason for hiding this comment

Uh oh!

ilija-lazoroski Nov 19, 2021

Choose a reason for hiding this comment

Uh oh!

mssalvatore Nov 19, 2021

Choose a reason for hiding this comment

Uh oh!

Uh oh!

VakarisZ left a comment

Choose a reason for hiding this comment

Uh oh!

VakarisZ commented Nov 19, 2021

Uh oh!

VakarisZ left a comment

Choose a reason for hiding this comment

Uh oh!

mssalvatore commented Nov 19, 2021

Uh oh!

shreyamalviya left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

shreyamalviya commented Nov 19, 2021

Uh oh!

VakarisZ commented Nov 22, 2021

Uh oh!

Uh oh!

ilija-lazoroski commented Nov 17, 2021 •

edited

Loading

codecov bot commented Nov 17, 2021 •

edited

Loading