Reaqta various mapping fixes

[DerekRushton]

No description provided.

[DerekRushton]

Explaining the changes :

1. Mitre tactics came as [1,2,3,4] where each number represented a tactic. The primary issue is that we require that the tactic_name must be a string and that it's required.

There were two possible solutions, we either map on the technique and change tactic_name to represent all the tactics, or we can create multiple mitre objects for each tactic. I've opted for the later to adhere to the extensions requirements.

Hence I've transformed the array into a dict object where each object has the technique, tactic_name (using the map from reaqta UI) and the tactic_number as an extension. Then the TTP references are grouped up for each tactic.

[DerekRushton]

Explaining the changes :

2. I've largely removed many references to x-ibm-finding. In my investigation I found that the x-ibm-findings were not really representing the associated alert, which the data does not give any information about. The only information associated with an alert came with a policy ID.

Thus, I've added x-ibm-finding results for the policy_id (using it as the name of the alert) and either remapped the other references to x-reaqta or event objects, or removed them completely if the didn't fit. To my knowledge, there is no loss of information as all of it should be available in other objects.

[DerekRushton]

Explaining the changes :

3. There existed an asset object that didn't quite make sense. It was always matching on the hostname_id which didn't really mean it was an asset. It was mapping some IP's to it, but there were no garuntee that IP's would be included. It was possible for their to be a host_id with no other fields.

I've changed this to no longer have that asset and instead map those fields to a reaqta extension object. There were other asset objects that made more sense.

[mdazam1942]

TACTIC_NAME_MAPPING.get(tactic) more readable?

maybe you wanna change the dictionary name to simple lowercase

[DerekRushton]

Is there a better way to indicate that a field should not be modified? That field (TACTIC_NAME_MAPPING) should not change during run-time.

[mdazam1942]

you can save it in stix_shifter_modules/reaqta/stix_translation/json and read it from there. but that would be a overkill. this is already hard coded in the code. so no one will be able to change it anyway. you can probably add a debug log and add something in the comment

[DerekRushton]

I'll just modify it to use the lower case. There is already a comment describing it's purpose.

[mdazam1942]

tactic_name_mapping.get(tactic) ?

[DerekRushton]

Yes, that's what I've left it as.

[mdazam1942]

is there a reason you need to f'string the tactic value?

[DerekRushton]

The mapping was in string, but the values were int. I've changed the mapping to match what the API responds with (int) so I won't need the f string.