MITRE ATT&CK Installation

Prerequisites

The following files are required for installation:

• sm-mitre archive with module files for OpenSearch
• smMitreAttack archive with module files for OpenSearch Dashboards

Installation Process

Installation on OpenSearch servers is performed using the following command:

sudo -u opensearch /app/opensearch/bin/opensearch-plugin install file://<Path to the module archive>

Installation on OpenSearch Dashboards servers is performed using the following command:

sudo -u opensearch /app/opensearch-dashboards/bin/opensearch-dashboards-plugin install file://<Path to the module archive>

After installing the module, you need to perform the actions listed in the Plugin Management.

Data Initialization

danger

If the installation does not have internet access, a file with the matrix (enterprise-attack.json) will be required for initialization. The file needs to be copied to the servers where the module is installed, in the directory:

/app/opensearch/config/mitre

When updating, the matrix is updated entirely; it is not possible to initialize only part of the matrix. Existing matrix settings will not be affected by the update.

To index the current MITRE ATT&CK matrix data from the internet, you need to execute a request in System Settings - Developer Console:

PUT _mitre/init/url

To index the MITRE ATT&CK matrix data from a file, you need to execute a request in System Settings - Developer Console:

PUT _mitre/init/file

Adding a Section to the Main Menu

To add the module component to the menu, go to the Main Menu - Settings - Module Settings - Menu Settings - JSON Structure section. Add the JSON dictionary below to the data list.

Menu MITRE ATT&CK

{
  "itemType": "module",
  "name": "mitre-attack",
  "show": false,
  "id": "85160308-30dc-4989-aa01-eb7d2425c8fe",
  "title": "MITRE ATT&CK®",
  "sections": [
    {
      "itemType": "page",
      "name": "matrix/priority",
      "show": false,
      "id": "29ef255e-1055-4cb7-94a8-c2ccdc84834d",
      "title": "Priority Matrix",
      "enabled": true
    },
    {
      "itemType": "page",
      "name": "matrix/detection",
      "show": false,
      "id": "aad0e6d1-e46b-4c41-a8f6-163a225a3e1a",
      "title": "Detection Matrix",
      "enabled": true
    },
    {
      "itemType": "page",
      "name": "matrix/coverage",
      "show": false,
      "id": "f0c40f5d-aeb9-4c92-90fb-c337a7f21840",
      "title": "Coverage Matrix",
      "enabled": true
    },
    {
      "itemType": "page",
      "name": "layers",
      "show": false,
      "id": "827eebe1-5c65-43cf-87fd-051cd533ae8c",
      "title": "Layer Editor",
      "enabled": true
    },
    {
      "itemType": "group",
      "group-sections": [
        {
          "itemType": "dashboard",
          "dashboard-type": "single",
          "name": "mitre_techniques_detections",
          "show": false,
          "id": "685bd5f0-1397-41bf-aca5-bb2b33ac9019",
          "title": "All Detections",
          "enabled": true
        },
        {
          "itemType": "dashboard",
          "dashboard-type": "single",
          "name": "mitre_techniques_detections_details",
          "show": false,
          "id": "fc02658e-7ed5-4b9a-a75c-e839a51a0c82",
          "title": "Detections Details",
          "enabled": true
        }
      ],
      "name": "mitre_detections",
      "show": false,
      "id": "a3d84cb1-c1c5-40f7-a235-065b4454862e",
      "title": "Detections",
      "previewShow": false,
      "enabled": true
    },
    {
      "itemType": "group",
      "group-sections": [
        {
          "itemType": "dashboard",
          "dashboard-type": "single",
          "name": "mitre_risk_scoring_summary",
          "show": false,
          "id": "08671c7c-6044-42b0-935e-dd2e7b88f938",
          "title": "Risk-scoring Summary",
          "enabled": true
        },
        {
          "itemType": "dashboard",
          "dashboard-type": "single",
          "name": "mitre_risk_object_analysis",
          "show": false,
          "id": "7d12ebf7-03a0-4977-a56d-2195312edb22",
          "title": "Object Analysis",
          "enabled": true
        }
      ],
      "name": "risk",
      "show": false,
      "id": "a335ebb4-fccb-46b9-85a1-c487d708878b",
      "title": "Risk-Scoring",
      "previewShow": false,
      "enabled": true
    }
  ],
  "enabled": true
}