Merge pull request #14091 from Security-Onion-Solutions/2.4/nav-airgap

Refactor Navigator Airgap

salt/nginx/config.sls

@@ -49,24 +49,6 @@ navigatorconfig:
     - makedirs: True
     - template: jinja
 
-navigatorpreattack:
-  file.managed:
-    - name: /opt/so/conf/navigator/layers/pre-attack.json
-    - source: salt://nginx/files/pre-attack.json
-    - user: 939
-    - group: 939
-    - makedirs: True
-    - replace: False
-
-navigatorenterpriseattack:
-  file.managed:
-    - name: /opt/so/conf/navigator/layers/enterprise-attack.json
-    - source: salt://nginx/files/enterprise-attack.json
-    - user: 939
-    - group: 939
-    - makedirs: True
-    - replace: False
-
 nginx_sbin:
   file.recurse:
     - name: /usr/sbin

salt/nginx/files/enterprise-attack.json

@@ -1 +0,0 @@
-{"type":"bundle","id":"bundle--1b5de6a3-1a45-4f85-8103-81cff6d77e22","objects":[{"tactic_refs":["x-mitre-tactic--daa4cbb1-b4f4-4723-a824-7f1efd6e0592","x-mitre-tactic--d679bca2-e57d-4935-8650-8031c87a4400","x-mitre-tactic--ffd5bcee-6e16-4dd2-8eca-7b3beedf33ca","x-mitre-tactic--4ca45d45-df4d-4613-8980-bac22d278fa5","x-mitre-tactic--5bc1d813-693e-4823-9961-abf9af4b0e92","x-mitre-tactic--5e29b093-294e-49e9-a803-dab3d73b77dd","x-mitre-tactic--78b23412-0651-46d7-a540-170a1ce8bd5a","x-mitre-tactic--2558fd61-8c75-4730-94c4-11926db2a263","x-mitre-tactic--c17c5845-175e-4421-9713-829d0573dbc9","x-mitre-tactic--7141578b-e50b-4dcc-bfa4-08a8dd689e9e","x-mitre-tactic--d108ce10-2419-4cf9-a774-46161d6c6cfe","x-mitre-tactic--f72804c5-f15a-449e-a5da-2eecd181f813","x-mitre-tactic--9a4e74ab-5008-408c-84bf-a10dfbc53462","x-mitre-tactic--5569339b-94c2-49ee-afb3-2222936582c8"],"object_marking_refs":["marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"],"id":"x-mitre-matrix--eafc1b4c-5e56-4965-bd4e-66a6a89c88cc","type":"x-mitre-matrix","created":"2018-10-17T00:14:20.652Z","created_by_ref":"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5","external_references":[{"external_id":"enterprise-attack","source_name":"mitre-attack","url":"https://attack.mitre.org/matrices/enterprise"}],"modified":"2022-04-01T20:43:55.937Z","name":"Enterprise ATT&CK","description":"Below are the tactics and technique representing the MITRE ATT&CK Matrix for Enterprise. The Matrix contains information for the following platforms: Windows, macOS, Linux, AWS, GCP, Azure, Azure AD, Office 365, SaaS.","x_mitre_version":"1.0","x_mitre_attack_spec_version":"2.1.0","x_mitre_modified_by_ref":"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"},{"x_mitre_domains":["enterprise-attack"],"object_marking_refs":["marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"],"id":"course-of-action--00d7d21b-69d6-4797-88a2-c86f3fc97651","type":"course-of-action","created":"2018-10-17T00:14:20.652Z","created_by_ref":"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5","external_references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/mitigations/T1174","external_id":"T1174"},{"url":"https://msdn.microsoft.com/library/windows/desktop/ms721766.aspx","description":"Microsoft. (n.d.). Installing and Registering a Password Filter DLL. Retrieved November 21, 2017.","source_name":"Microsoft Install Password Filter n.d"}],"modified":"2019-07-25T11:22:19.139Z","name":"Password Filter DLL Mitigation","description":"Ensure only valid password filters are registered. Filter DLLs must be present in Windows installation directory (<code>C:\\Windows\\System32\\</code> by default) of a domain controller and/or local computer with a corresponding entry in <code>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Notification Packages</code>. (Citation: Microsoft Install Password Filter n.d)","x_mitre_deprecated":true,"x_mitre_version":"1.0","x_mitre_modified_by_ref":"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"},{"x_mitre_domains":["enterprise-attack"],"object_marking_refs":["marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"],"id":"course-of-action--02f0f92a-0a51-4c94-9bda-6437b9a93f22","type":"course-of-action","created":"2018-10-17T00:14:20.652Z","created_by_ref":"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5","external_references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/mitigations/T1151","external_id":"T1151"}],"modified":"2019-07-25T11:46:32.010Z","name":"Space after Filename Mitigation","description":"Prevent files from having a trailing space after the extension.","x_mitre_deprecated":true,"x_mitre_version":"1.0","x_mitre_modified_by_ref":"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"},{"x_mitre_domains":["enterprise-attack"],"object_marking_refs":["marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"],"id":"course-of-action--03c0c586-50ed-45a7-95f4-f496d7eb5330","type":"course-of-action","created":"2018-10-17T00:14:20.652Z","created_by_ref":"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5","external_references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/mitigations/T1148","external_id":"T1148"},{"url":"http://www.akyl.net/securing-bashhistory-file-make-sure-your-linux-system-users-won%E2%80%99t-hide-or-delete-their-bashhistory","description":"Mathew Branwell. (2012, March 21). Securing .bash_history file. Retrieved July 8, 2017.","source_name":"Securing bash history"}],"modified":"2019-07-24T19:34:34.065Z","name":"HISTCONTROL Mitigation","description":"Prevent users from changing the <code>HISTCONTROL</code> environment variable (Citation: Securing bash history). Also, make sure that the <code>HISTCONTROL</code> environment variable is set to “ignoredup” instead of “ignoreboth” or “ignorespace”.","x_mitre_deprecated":true,"x_mitre_version":"1.0","x_mitre_modified_by_ref":"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"},{"x_mitre_domains":["enterprise-attack"],"object_marking_refs":["markiLine truncated

salt/nginx/files/navigator_config.json

@@ -1,21 +1,24 @@
 {%- set URL_BASE = salt['pillar.get']('global:url_base', '') %}
 
 {
-    "collection_index_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/index.json",
+    "collection_index_url": "",
 
-    "versions": [
+"versions": {
+    "enabled": true,
+    "entries": [
         {
-            "name": "ATT&CK v16",
+            "name": "MITRE ATT&CK",
             "version": "16",
             "domains": [
-                {   
+                {
                     "name": "Enterprise",
                     "identifier": "enterprise-attack",
-                    "data": ["assets/so/enterprise-attack.json"]
+                    "data": ["assets/mitre/enterprise-attack.json"]
                 }
             ]
         }
-    ],
+    ]
+},
 
     "custom_context_menu_items": [ 
         {"label": "View related Detections","url": "  https://{{URL_BASE}}/#/detections?q=*{{ "{{technique_attackID}}" }}*+|+groupby+so_detection.language+|+groupby+so_detection.ruleset+so_detection.isEnabled+|+groupby+%22so_detection.category%22&z=America/New_York&el=500&gl=50&rt=0&rtu=hours"},