Add CLOAK (Concealment Layers) MISP galaxy and cluster#1229
Merged
Conversation
…Knowledge) ### Motivation - Provide a MISP matrix-style galaxy for the CLOAK knowledge base (Concealment Layers for Online Anonymity and Knowledge) so concealment techniques can be referenced and used in MISP. - Preserve attribution and direct references to the original CLOAK repository and source JSON while improving usability for MISP consumers. - Expand and normalise sparse descriptions in the original data to give operational context for investigation, gap analysis and defensive planning. ### Description - Add `galaxies/cloak.json` containing a matrix-style galaxy with `kill_chain_order` listing 13 concealment tactic columns and metadata (name, description, icon, uuid, version, namespace). - Add `clusters/cloak.json` containing 13 cluster values (one per tactic) with detailed `description` and `meta` fields that include `attribution`, `external_id`, `kill_chain` mapping, `layer`, `matrix`, `refs`, `source_notes`, and `technique_examples`. - Generate stable UUIDs for the galaxy and cluster entries and set `source` to the original repository `https://github.com/Mickinthemiddle/CLOAK` and reference the original `concealment-data.json` and `https://opsectechniques.com` for discoverability. - Commit the new files and ensure formatting follows project conventions (`jq`/indentation, non-executable JSON files). ### Testing - Ran `jq empty galaxies/cloak.json clusters/cloak.json` to ensure valid JSON formatting, which succeeded. - Ran project checks including `git diff --check` and basic Python schema-shape assertions that verify required fields and that each cluster item contains a `value`, which succeeded. - Executed `validate_all.sh` which formatted and ran repository maintenance tasks (including `tools/add_missing_uuid.py`) and did not report blocking errors for the added files. - Attempted full `jsonschema` validation via a local Python script, but `jsonschema` / `typing_extensions` in the execution environment raised an import error, so full programmatic schema validation could not be completed in this environment (this is an environment issue, not a change in the PR).
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2b19522230
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ], | ||
| "related_misp_galaxies_note": "Relationships are best-effort analytical mappings to existing MISP MITRE ATT&CK attack-pattern clusters where CLOAK concealment tactics overlap with ATT&CK adversary behaviors; they are not asserted as source-published CLOAK mappings." | ||
| }, | ||
| "uuid": "594c1b33-aac8-5cfd-83db-fc46aeb26ed7", |
There was a problem hiding this comment.
In a clean checkout, ./validate_all.sh first runs ./jq_all_the_things.sh, which rewrites every cluster with jq --sort-keys, then fails if git status --porcelain is non-empty. This new file is not in that canonical order (for example related sorts before uuid here), so CI will dirty the tree and fail until the cluster JSON is regenerated with the formatter.
Useful? React with 👍 / 👎.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Description
clusters/cloak.jsoncontaining 13 CLOAK tactics with descriptions, metadata, UUIDs, related mappings, and examples for MISP use.galaxies/cloak.jsondefining the CLOAK galaxy, icon, kill-chain ordering, namespace, UUID, and version.metasection and include best-effort mappings to MITRE ATT&CK-related clusters where applicable.1and ensure the cluster entries cover the described concealment categories (anonymous browsing, communication, finance, hosting, identities, environments, anti-forensics, detection avoidance, compartmentalization, data protection, deception, operational discipline, and physical resilience).Testing
jq/equivalent) and ensured they are well-formed.Codex Task