attack LinkML schema

src/attack/schema/attack.yaml is the schema, titled “MITRE ATT&CK”. Its header gives version: "20.0", the ATT&CK release, and source, that release of mitre-attack/attack-stix-data. Its annotations name the data’s commit, the ATT&CK specification 3.3.0, the ATT&CK Data Model (ADM) release v4.11.7 and its commit, and STIX 2.1. Its comments say why it follows v4.11.7, which MITRE marks as a pre-release, and that it follows MITRE’s data where the data departs from the ADM.¹ It imports the six stix modules under src/attack/schema/stix/.

Seventeen classes describe ATT&CK’s objects, each extending the STIX class it builds on: AttackTechnique (attack-pattern), AttackTactic, AttackGroup (intrusion-set), AttackCampaign, AttackMalware, AttackTool, AttackMitigation (course-of-action), AttackMatrix, AttackCollection, AttackAsset, AttackDataSource, AttackDataComponent, AttackDetectionStrategy, AttackAnalytic, AttackRelationship, AttackIdentity and AttackMarkingDefinition. AttackBundle extends StixBundle. Six helper classes hold the objects ATT&CK inlines, such as a kill chain phase, a log source and a collection’s version reference.¹

Each class names its STIX type in a stix_type annotation and, where ATT&CK gives one, the form of its ATT&CK ID in attack_id_pattern. AttackRelationship closes the relationship type to ATT&CK’s seven and has eight rules on the types of object each may join. AttackDataSource and eight slots are deprecated, as the ADM deprecates them for specification 4.0.0.

The bundle’s domain schema is .lokf/attack.yaml, which lokf adapt writes from this file. Edit the source, never the copy.² The schema := line of .lokf/justfile and the [tool.lokf] table of .lokf/pyproject.toml both name it. project.justfile roots the copy on StixObject and StixBundle and passes --prefix stix, so the STIX keys LOKF also defines become stix_type, stix_name and the like, as in lmodel/stix’s own copy.³ The copy’s notes record those renames and the two roots.⁴

Footnotes

Section titled “Footnotes”

1. src/attack/schema/attack.yaml, the header and the classes ↩ ↩²

2. README.md, the Knowledge Trust Ladder (KTL) section ↩

3. project.justfile, the knowledge bundle recipes ↩

4. .lokf/attack.yaml, the notes ↩