attackevals / website

ATT&CK Evaluations Website

MITRE Engenuity ATT&CK^® Evaluations Website

See the live site at attackevals.mitre-engenuity.org!

This repository contains the source code used to generate the MITRE ATT&CK^® Evaluations website as seen at attackevals.mitre-engenuity.org.

Related MITRE Work

ATT&CK

MITRE ATT&CK^® Website

CTI

Cyber Threat Intelligence repository of the ATT&CK catalog expressed in STIX 2.0 JSON.

ATT&CK Navigator

The ATT&CK Navigator is an open-source tool providing basic navigation and annotation of ATT&CK matrices, something that people are already doing today in tools like Excel. It is designed to be simple and generic - you can use the Navigator to visualize your defensive coverage, your red/blue team planning, the frequency of detected techniques, and more.

https://github.com/mitre-attack/attack-navigator

STIX

Structured Threat Information Expression (STIX^™) is a language and serialization format used to exchange cyber threat intelligence (CTI).

STIX enables organizations to share CTI with one another in a consistent and machine readable manner, allowing security communities to better understand what computer-based attacks they are most likely to see and to anticipate and/or respond to those attacks faster and more effectively.

STIX is designed to improve many different capabilities, such as collaborative threat analysis, automated threat exchange, automated detection and response, and more.

https://oasis-open.github.io/cti-documentation/

Notice

© 2018 - 2021, The MITRE Corporation and MITRE Engenuity

Approved for Public Release; Distribution Unlimited. Case Numbers 19-3504 and AT-0005

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

ATT&CK Evaluations Terms of Use - https://attackevals.mitre-engenuity.org/terms-of-use

This project makes use of ATT&CK^®
ATT&CK^® Terms of Use - https://attack.mitre.org/resources/terms-of-use/

website's Issues

web server is not configured to send full trust chain for the web site

The nginx server acting as the server/reverse proxy for https://attackevals.mitre-engenuity.org is not sending the full trust chain on TLS handshake; it's only sending the host certificate. Browsers work around this; but if there is a firewall in the middle doing SSL decrypt and enforcing full trust chains, this causes page load errors (particularly when combined with HSTS).

https://www.ssllabs.com/ssltest/analyze.html?d=attackevals.mitre-engenuity.org

In the NGINX case, the certificates file in the config needs to have the host certificate before the CA bundle in the combined file. The missing intermediate chain is for Entrust Certification Authority - L1K