Machine-parseable diff about attack-scripts HOT 2 CLOSED

Hi @mvglasow,

diff_stix does actually include such an output, but only if you access the diff_stix instance programmatically. If you construct a new DiffStix instance you should be able to access the contents of the data property after it initializes, which includes all the change types exported in the markdown (and layer) output formats:

https://github.com/mitre-attack/attack-scripts/blob/master/scripts/diff_stix.py#L104-L117

• It does not at present implement granular change detection as described in #11.
• Revocations are also stored but are a bit harder to access, you may want to read through the implementation to reverse engineer how to get at those.

If you want to create a new output format for diff_stix (e.g a csv, json or xlsx representation of the changes), or an implementation of #11, feel free to submit it as a PR to this repo.

One other thing to note is that comparison of two versions of the dataset is also being implemented in another ATT&CK project mentioned in the January ATT&CKcon power hour -- the ATT&CK Workbench project will include functionalities (a UI and API) for assessing update/change information in a manner similar to diff_stix.

I'll leave this issue open to document the need for a machine readable output (json/csv/xlsx) aside from the contents of the internal data struct.

from attack-scripts.

This is now implemented in the --json-file option which can be seen here: https://github.com/mitre-attack/mitreattack-python/tree/master/mitreattack/diffStix

Admin note: closing all remaining issues and pull requests prior to archiving the repository

from attack-scripts.