ATT&CK Spec 4.0.0 - Detection Strategies, Analytics, and Log Sources (Draft) #18

seansica · 2025-03-21T19:36:42Z

Changes

Contains changes that will mark the release of ATT&CK Specification 4.0.0.
New ATT&CK object type: Detection Stategy (x-mitre-detection-strategy)
New ATT&CK object type: Analytic (x-mitre-analytic)
New ATT&CK object type: Log Source (x-mitre-log-source)
New Relationship (SRO) type: found-in
Data Sources are now deprecated and will be removed in ATT&CK Specification 5.x
Includes major refactors, including migration to Zod v4

See #14 for a detailed summary of the specification changes.

Notably, this change is not final. Unit tests still need to be implemented. Further changes to the specification may occur before the official 4.0.0 release.

- Remove x-mitre-data-source type - Add x-mitre-detection and x-mitre-log-source types

- TODO is for remembering to replace x_mitre_data_source_ref property with new x_mitre_data_log_ref

- Add new schema, MITRE Log Source, that replaces MITRE Data Source - Update related components to use Log Source instead of Data Source BREAKING CHANGE: The MITRE Data Source type is being replaced by Log Sources. Data sources will be deprecated and removed in the next major ATT&CK specification version.

- Rewrite all Zod schemas that implement well-defined open vocabularies to use proper case with OV suffix

- Add type field for indicator - Add type field for x-mitre-analytic - Note that x-mitre-detection and x-mitre-analytic are still being evaluated as candidate custom SDO types (subject to change)

- Move MitreCollectionLayersOV to open-vocabularies.ts module - Implement new PatternTypeOV (to be used in Indicators) - Implement new IndicatorTypeOV (to be used in Indicators)

- This schema is still a work-in-progress - This iteration may not be the finalized version

- The attack-data-model.ts module was using the now deprecated DataSource and DataSourceImpl - Both have been replaced by LogSource and LogSource impl, respectively - This can be thought of as a simple rename

- Implements the Indicator SDO definition from STIX 2.1 - Deviates from STIX 2.1 spec by specifying valid_from as optional (too strict for ATT&CK uses)

- Was previously set to a singular external reference instance - Fixed to be an array of external references

- Rename variables, functions, and classes from dataSource to logSource - Update file names containing 'dataSource' to use 'logSource' - Replace references in comments and documentation - Update import statements across the codebase

clemiller · 2025-03-25T17:05:04Z

src/schemas/sdo/data-component.schema.ts

The data component schema will need to be updated to support ATT&CK IDs with a refinement that validates the ID exists and matches the pattern DC####

clemiller · 2025-03-25T17:08:43Z

src/schemas/sdo/index.ts

May want to add export statements for indicators & detections here

clemiller · 2025-03-25T17:30:42Z

src/schemas/sdo/technique.schema.ts


-    if (x_mitre_data_sources && inMobileDomain) {
+    if (x_mitre_log_sources && inMobileDomain) {
      ctx.addIssue({
        code: z.ZodIssueCode.custom,
-        message: "x_mitre_data_sources is not supported in the 'mobile-attack' domain.",
+        message: "x_mitre_log_sources is not supported in the 'mobile-attack' domain.",
      });


I'm not sure if it makes sense to rename this field to log sources. Maybe we should consider removing it altogether? The x_mitre_data_sources field hasn't been supported/updated for a while and was effectively replaced by "detects" relationships with Data Components. Any techniques still using this field likely contain outdated information that hasn't kept up with the current Data Sources, and this would probably become even more apparent as we transition toward Log Sources.

src/schemas/common/open-vocabulary.ts

src/schemas/sro/relationship.schema.ts

clemiller · 2025-03-27T16:54:42Z

src/schemas/sdo/stix-bundle.schema.ts

  | Campaign
  | Collection
  | DataComponent
-  | DataSource
+  | LogSource
  | Identity
  | Matrix
  | Tool


Will need to add Indicators and Detections as valid AttackObject types here

clemiller · 2025-03-27T16:55:14Z

src/schemas/sdo/stix-bundle.schema.ts

      campaignSchema,
      collectionSchema,
      dataComponentSchema,
-      dataSourceSchema,
+      logSourceSchema,
      identitySchema,
      matrixSchema,
      toolSchema,


Will need to add Indicator and Detection schemas here as well

…urces - Data Sources will remain supported until ATT&CK spec 4.0.0 - Log Source tests will be restored after the schema is finalized

- Implement dual support for x_mitre_data_sources and x_mitre_log_sources - Refactor refinements to Zod v4 syntax

- x_mitre_domains was removed from all identities starting in ATT&CK v17.0 - Not a breaking change because this should have been codified in ATT&CK spec 3.2.0 or earlier

…k in progress)

…ources

- Add x-mitre-detection-strategy to detects.source array alongside existing x-mitre-data-component - Enables detection strategies to target attack patterns via detects relationship type - Maintains backward compatibility with existing data component relationships

- They will not be used in the next spec revision related to detection strategies

…egy, and data component

…equirements

- z.SafeParseReturnType appears to no longer be supported in Zod v4 - Removed it from main.ts - Fixed an import error and rolled log source references back to data sources in refinements.ts

- The tests that check relationships and STIX bundles take particularly long to run - >=2200ms for relationships and >=3000ms for STIX bundles when run locally - They frequently exceed the 5000ms timeout threshold when run on GitHub Actions - Increased to 10_000 (10s)

- Add conditional to publish job to only run on push events - Restrict deploy-docs job to main branch pushes only - Prevents external contributors from triggering releases via PRs

github-actions · 2025-07-01T14:20:19Z

🎉 This PR is included in version 4.0.0-alpha.1 🎉

The release is available on:

Your semantic-release bot 📦🚀

github-actions · 2025-07-21T17:51:34Z

🎉 This PR is included in version 4.0.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

github-actions · 2025-07-21T18:13:57Z

🎉 This PR is included in version 4.0.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

seansica added 18 commits March 5, 2025 12:54

feat!: update supported STIX types

2bb2233

- Remove x-mitre-data-source type - Add x-mitre-detection and x-mitre-log-source types

chore(husky): make commit-msg executable

9d745c6

feat: add new schema for detections

64bb481

feat: add new schema for log sources

0634c54

feat: add new relationship type (found-in) to relationshipTypeSchema

5f8b9d3

docs: add TODO to data-component.schema

7c6f509

- TODO is for remembering to replace x_mitre_data_source_ref property with new x_mitre_data_log_ref

refactor(OV): rename open vocab enums

973d781

- Rewrite all Zod schemas that implement well-defined open vocabularies to use proper case with OV suffix

feat(schema): update stix types

53a8431

- Add type field for indicator - Add type field for x-mitre-analytic - Note that x-mitre-detection and x-mitre-analytic are still being evaluated as candidate custom SDO types (subject to change)

style: apply formatting

1276b5e

feat(schema): add new open vocabularies

b1ec79e

- Move MitreCollectionLayersOV to open-vocabularies.ts module - Implement new PatternTypeOV (to be used in Indicators) - Implement new IndicatorTypeOV (to be used in Indicators)

feat(schema): update detection schema

400a74b

- This schema is still a work-in-progress - This iteration may not be the finalized version

fix(adm): replace DataSource refs with LogSource

6c691f4

- The attack-data-model.ts module was using the now deprecated DataSource and DataSourceImpl - Both have been replaced by LogSource and LogSource impl, respectively - This can be thought of as a simple rename

feat(schema): add new indicator schema

8321caf

- Implements the Indicator SDO definition from STIX 2.1 - Deviates from STIX 2.1 spec by specifying valid_from as optional (too strict for ATT&CK uses)

fix(schema): set external_references to array in log sources

0e8e413

- Was previously set to a singular external reference instance - Fixed to be an array of external references

refactor: migrate from data sources to log sources

7d06f82

- Rename variables, functions, and classes from dataSource to logSource - Update file names containing 'dataSource' to use 'logSource' - Replace references in comments and documentation - Update import statements across the codebase

refactor: remove x-mitre-analytic stix type

6da4a4f

refactor: update error handling module to reflect changes to stix types

8cdbecb

seansica requested review from clemiller and jondricek March 21, 2025 19:36

seansica self-assigned this Mar 21, 2025

seansica requested a review from elucchesileon March 21, 2025 20:54

clemiller reviewed Mar 25, 2025

View reviewed changes

elucchesileon reviewed Mar 27, 2025

View reviewed changes

src/schemas/common/open-vocabulary.ts Outdated Show resolved Hide resolved

elucchesileon reviewed Mar 27, 2025

View reviewed changes

src/schemas/sro/relationship.schema.ts Outdated Show resolved Hide resolved

clemiller reviewed Mar 27, 2025

View reviewed changes

fix(schema): define found-in in RelationshipMap

ca1a43f

seansica added 19 commits June 30, 2025 10:58

fix: add missing extensions import in schemas/common/index.ts

a6488e7

feat(attack-id): add support for log source attack identifier LS####

beb147d

style: apply formatting and linting

e86933c

test: restore unit tests for data sources and remove tests for log so…

3b74cee

…urces - Data Sources will remain supported until ATT&CK spec 4.0.0 - Log Source tests will be restored after the schema is finalized

fix(technique.schema): restore compatibility for x_mitre_data_sources

d5c6b8d

- Implement dual support for x_mitre_data_sources and x_mitre_log_sources - Refactor refinements to Zod v4 syntax

fix(identity.schema): remove support for x_mitre_domains

90e2887

- x_mitre_domains was removed from all identities starting in ATT&CK v17.0 - Not a breaking change because this should have been codified in ATT&CK spec 3.2.0 or earlier

feat(analytic.schema): add new x-mitre-analytic sdo (schema still wor…

ef14120

…k in progress)

docs: update COMPATBILITY.md

60df9ab

Merge branch 'next' into 14-update-taxonomy-for-data-components-and-s…

bd29bf9

…ources

build: re-sync package-lock.json

3f23190

fix(indicator.schema): remove indicators

c0b6e5d

- They will not be used in the next spec revision related to detection strategies

feat: add attack id support for log source, analytic, detection strat…

a2f58d2

…egy, and data component

fix: update stix bundle schema to support analytics

931efea

feat: align analytics and detection strategy with latest spec draft r…

da862eb

…equirements

feat: align log source schema with latest spec draft requirements

a0a48c8

fix: resolve builtime errors

cb42fe9

- z.SafeParseReturnType appears to no longer be supported in Zod v4 - Removed it from main.ts - Fixed an import error and rolled log source references back to data sources in refinements.ts

fix(ci): restrict publish and deploy jobs to push events only

fb22c59

- Add conditional to publish job to only run on push events - Restrict deploy-docs job to main branch pushes only - Prevents external contributors from triggering releases via PRs

seansica changed the base branch from next to alpha July 1, 2025 14:08

seansica changed the title ~~draft: update taxonomy for data components and sources~~ ATT&CK Spec 4.0.0 - Detection Strategies, Analytics, and Log Sources Jul 1, 2025

seansica changed the title ~~ATT&CK Spec 4.0.0 - Detection Strategies, Analytics, and Log Sources~~ ATT&CK Spec 4.0.0 - Detection Strategies, Analytics, and Log Sources (Draft) Jul 1, 2025

seansica merged commit 25cf2f2 into alpha Jul 1, 2025
4 checks passed

seansica deleted the 14-update-taxonomy-for-data-components-and-sources branch July 1, 2025 14:18

github-actions bot added the released on @alpha label Jul 1, 2025

github-actions bot added the released on @next label Jul 21, 2025

github-actions bot added the released label Jul 21, 2025

ATT&CK Spec 4.0.0 - Detection Strategies, Analytics, and Log Sources (Draft) #18

ATT&CK Spec 4.0.0 - Detection Strategies, Analytics, and Log Sources (Draft) #18

Uh oh!

Conversation

seansica commented Mar 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

clemiller Mar 25, 2025

Choose a reason for hiding this comment

Uh oh!

clemiller Mar 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elucchesileon Mar 27, 2025

Choose a reason for hiding this comment

Uh oh!

clemiller Mar 25, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

clemiller Mar 27, 2025

Choose a reason for hiding this comment

Uh oh!

elucchesileon Mar 27, 2025

Choose a reason for hiding this comment

Uh oh!

clemiller Mar 27, 2025

Choose a reason for hiding this comment

Uh oh!

elucchesileon Mar 27, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Jul 1, 2025

Uh oh!

github-actions bot commented Jul 21, 2025

Uh oh!

github-actions bot commented Jul 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

seansica commented Mar 21, 2025 •

edited

Loading

clemiller Mar 25, 2025 •

edited

Loading