feat(cti): add Cyber Threat Intelligence info (#1442)

* feat(cti): add Cyber Threat Intelligence info

* chore: replace io/ioutil as it is deprecated

* chore: remove --format-csv in stdout writer

* chore(deps): go get go-cti@v0.0.1

* feat(cti): update cti dict(support MITRE ATT&CK v11.1)

* chore(deps): go get go-cti@master
This commit is contained in:
MaineK00n
2022-06-15 08:08:12 +00:00
committed by GitHub
parent 86b60e1478
commit 5234306ded
28 changed files with 4406 additions and 109 deletions

View File

@@ -42,6 +42,7 @@ type Config struct {
Exploit ExploitConf `json:"exploit,omitempty"`
Metasploit MetasploitConf `json:"metasploit,omitempty"`
KEVuln KEVulnConf `json:"kevuln,omitempty"`
Cti CtiConf `json:"cti,omitempty"`
Slack SlackConf `json:"-"`
EMail SMTPConf `json:"-"`
@@ -178,6 +179,7 @@ func (c *Config) ValidateOnReport() bool {
&Conf.Exploit,
&Conf.Metasploit,
&Conf.KEVuln,
&Conf.Cti,
} {
if err := cnf.Validate(); err != nil {
errs = append(errs, xerrors.Errorf("Failed to validate %s: %+v", cnf.GetName(), err))

View File

@@ -32,6 +32,7 @@ func (c TOMLLoader) Load(pathToToml string) error {
&Conf.Exploit,
&Conf.Metasploit,
&Conf.KEVuln,
&Conf.Cti,
} {
cnf.Init()
}

View File

@@ -301,3 +301,30 @@ func (cnf *KEVulnConf) Init() {
cnf.setDefault("go-kev.sqlite3")
cnf.DebugSQL = Conf.DebugSQL
}
// CtiConf is go-cti config
type CtiConf struct {
VulnDict
}
const ctiDBType = "CTI_TYPE"
const ctiDBURL = "CTI_URL"
const ctiDBPATH = "CTI_SQLITE3_PATH"
// Init set options with the following priority.
// 1. Environment variable
// 2. config.toml
func (cnf *CtiConf) Init() {
cnf.Name = "cti"
if os.Getenv(ctiDBType) != "" {
cnf.Type = os.Getenv(ctiDBType)
}
if os.Getenv(ctiDBURL) != "" {
cnf.URL = os.Getenv(ctiDBURL)
}
if os.Getenv(ctiDBPATH) != "" {
cnf.SQLite3Path = os.Getenv(ctiDBPATH)
}
cnf.setDefault("go-cti.sqlite3")
cnf.DebugSQL = Conf.DebugSQL
}