feat: v1.8 — MITRE ATT&CK® technique mapping + coverage - #14
Merged
Conversation
Adds a curated Essential Eight → MITRE ATT&CK® Enterprise v19.1 layer, mapping 65 of 67 implementation steps to adversary techniques with Prevent / Detect / Recover / Support relationships. - 35-technique catalogue pinned to ATT&CK v19.1, transcribed from mitreattacke8.md and validated against the v19.1 STIX bundle. - Coverage engine scoped to the active profile, target maturity level and OS scope, with Not Applicable steps removed from the denominator and Support-only mappings reported as Indirect rather than covered. - Technique capsules on each step, a cross-control technique detail sheet, a tactic-grouped coverage screen and a per-control rollup. Coverage surfaces are hidden under Reference Only Mode. - Global Search matches technique IDs, parent IDs, canonical names and mapping notes. - MITRE attribution, derived-mapping disclaimer and coverage caveat, per MITRE's Terms of Use and branding rules. - Splash, marketing version and build bumped to 1.8 (9). Steps 2-1-2 and 6-1-2 are deliberately unmapped: defender asset inventory is not the adversary discovery behaviour described by T1518 / T1082. A test asserts this so the omission has to be removed knowingly. Tests: 42 unit tests covering mapping integrity, the closed catalogue and coverage maths; 18 UI tests. The UI suite was failing before this change for reasons unrelated to ATT&CK and is now green — launch arguments land in NSArgumentDomain and cannot be overridden from the UI, and -targetMaturityLevel / -osScopeFilter have been inert since v1.7 moved that state onto the profile. Affected tests now drive the UI instead. Verified: 42 unit + 18 UI tests pass, serially, on a freshly erased iPhone 17 simulator. Co-Authored-By: Claude Opus 5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Merges the shipped v1.8 release into
main. This code is already live on the App Store (MARKETING_VERSION = 1.8, build 9) but was never merged back, leavingmaina release behind at v1.7.Adds MITRE ATT&CK® Enterprise v19.1 technique mapping and coverage:
ATTACKCatalogue— 35 curated techniques, validated against the ATT&CK STIX bundleATTACKMappingData— per-step technique mappings with prevent/detect/recover/support relationships and analyst caveatsATTACKCoverage— coverage calculation scoped to target maturity level and OS scopeATTACKCoverageView/ATTACKTechniqueDetailView— coverage summary by tactic, technique detail with mapped stepsMaturityLevelView; ATT&CK IDs searchable inGlobalSearchViewAboutView(required by MITRE's Terms of Use)mitreattacke8.md— mapping rationale and sourceFast-forward from
main: 1 commit ahead, 0 behind, no conflicts.Why now
maindid not reflect the shipped release, so any v1.9 work branched frommainwould silently drop this entire feature set. Merging restoresmainas the source of truth before v1.9 begins.Test plan
Essential_8_Knowledge_BaseTests,Essential_8_Knowledge_BaseUITests)Follow-ups
v1.8on merge so the shipped commit is identifiable — the repo currently has no tagsfix/privacy-statement-accuracyis branched off this branch and targets v1.9🤖 Generated with Claude Code