DataSourcesDefinition.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# ATT&CK® Data Sources Definition\n",
    "\n",
    "---------------------------------"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* **Author**: Jose Luis Rodriguez - [@Cyb3rPandaH](https://twitter.com/Cyb3rPandaH)\n",
    "* **Organization**: [MITRE ATT&CK](https://attack.mitre.org/)\n",
    "* **Blog Reference**: \n",
    " - [Defining ATT&CK Data Sources, Part I: Enhancing the Current State](https://medium.com/mitre-attack/defining-attack-data-sources-part-i-4c39e581454f)\n",
    " - [Defining ATT&CK Data Sources, Part II: Operationalizing the Methodology](https://medium.com/mitre-attack/defining-attack-data-sources-part-ii-1fc98738ba5b)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Goal & Scope"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The present notebook is intended to provide basic examples of how can you merge **current data sources information** from **ATT&CK** and **new metadata** provided for **data source objects**. The examples provided consider (sub)techniques for the windows platform within the enterprise matrix."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Requeriments"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* [Python 3](https://www.python.org)\n",
    "* [attackcti](https://pypi.org/project/attackcti/)\n",
    "* [pandas](https://pandas.pydata.org/)\n",
    "* [yaml](https://pyyaml.org/wiki/PyYAML)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## First: Gathering current ATT&CK data sources metadata"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Importing python libraries and modules"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Importing library to interact with up to date ATT&CK content available in STIX format via public TAXII server\n",
    "from attackcti import attack_client\n",
    "\n",
    "# Importing library to manipulate data\n",
    "import pandas as pd\n",
    "from pandas import json_normalize"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Getting (sub)techniques"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>tactic</th>\n",
       "      <th>technique_id</th>\n",
       "      <th>technique</th>\n",
       "      <th>data_sources</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>[defense-evasion, persistence, command-and-con...</td>\n",
       "      <td>T1205.001</td>\n",
       "      <td>Port Knocking</td>\n",
       "      <td>[Netflow/Enclave netflow, Packet capture]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1564.006</td>\n",
       "      <td>Run Virtual Instance</td>\n",
       "      <td>[Packet capture, Host network interface, Windo...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1564.005</td>\n",
       "      <td>Hidden File System</td>\n",
       "      <td>[File monitoring, Windows Registry]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>[persistence, privilege-escalation, defense-ev...</td>\n",
       "      <td>T1574.012</td>\n",
       "      <td>COR_PROFILER</td>\n",
       "      <td>[Windows Registry, File monitoring, Process mo...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1480.001</td>\n",
       "      <td>Environmental Keying</td>\n",
       "      <td>[Process monitoring]</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                                              tactic technique_id  \\\n",
       "0  [defense-evasion, persistence, command-and-con...    T1205.001   \n",
       "1                                  [defense-evasion]    T1564.006   \n",
       "2                                  [defense-evasion]    T1564.005   \n",
       "3  [persistence, privilege-escalation, defense-ev...    T1574.012   \n",
       "4                                  [defense-evasion]    T1480.001   \n",
       "\n",
       "              technique                                       data_sources  \n",
       "0         Port Knocking          [Netflow/Enclave netflow, Packet capture]  \n",
       "1  Run Virtual Instance  [Packet capture, Host network interface, Windo...  \n",
       "2    Hidden File System                [File monitoring, Windows Registry]  \n",
       "3          COR_PROFILER  [Windows Registry, File monitoring, Process mo...  \n",
       "4  Environmental Keying                               [Process monitoring]  "
      ]
     },
     "execution_count": 2,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Instantiating attack_client class\n",
    "lift = attack_client()\n",
    "\n",
    "# Collecting all techniques (Revoked and not revoked) for windows platform within the enterprise matrix\n",
    "attck = lift.get_techniques_by_platform(name = 'Windows', stix_format = False)\n",
    "\n",
    "# Removing revoked techniques\n",
    "attck = lift.remove_revoked(attck)\n",
    "\n",
    "# Generating a dataframe with information collected\n",
    "attck = json_normalize(attck)\n",
    "\n",
    "# Selecting columns\n",
    "attck = attck[['tactic','technique_id','technique','data_sources']]\n",
    "\n",
    "# Showing information collected\n",
    "attck.head()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Splitting data_sources field"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>tactic</th>\n",
       "      <th>technique_id</th>\n",
       "      <th>technique</th>\n",
       "      <th>data_sources</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>[defense-evasion, persistence, command-and-con...</td>\n",
       "      <td>T1205.001</td>\n",
       "      <td>Port Knocking</td>\n",
       "      <td>Netflow/Enclave netflow</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>[defense-evasion, persistence, command-and-con...</td>\n",
       "      <td>T1205.001</td>\n",
       "      <td>Port Knocking</td>\n",
       "      <td>Packet capture</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1564.006</td>\n",
       "      <td>Run Virtual Instance</td>\n",
       "      <td>Packet capture</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1564.006</td>\n",
       "      <td>Run Virtual Instance</td>\n",
       "      <td>Host network interface</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1564.006</td>\n",
       "      <td>Run Virtual Instance</td>\n",
       "      <td>Windows Registry</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                                              tactic technique_id  \\\n",
       "0  [defense-evasion, persistence, command-and-con...    T1205.001   \n",
       "1  [defense-evasion, persistence, command-and-con...    T1205.001   \n",
       "2                                  [defense-evasion]    T1564.006   \n",
       "3                                  [defense-evasion]    T1564.006   \n",
       "4                                  [defense-evasion]    T1564.006   \n",
       "\n",
       "              technique             data_sources  \n",
       "0         Port Knocking  Netflow/Enclave netflow  \n",
       "1         Port Knocking           Packet capture  \n",
       "2  Run Virtual Instance           Packet capture  \n",
       "3  Run Virtual Instance   Host network interface  \n",
       "4  Run Virtual Instance         Windows Registry  "
      ]
     },
     "execution_count": 3,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "attck = attck.explode('data_sources').reset_index(drop=True)\n",
    "attck.head()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Second: Gathering new metadata of data source objects"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Importing python libraries"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [],
   "source": [
    "import yaml"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Getting metadata of data source objects"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>name</th>\n",
       "      <th>definition</th>\n",
       "      <th>collection_layers</th>\n",
       "      <th>platforms</th>\n",
       "      <th>contributors</th>\n",
       "      <th>data_components</th>\n",
       "      <th>references</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>Service</td>\n",
       "      <td>Information about software programs that run i...</td>\n",
       "      <td>[host]</td>\n",
       "      <td>[Windows]</td>\n",
       "      <td>[ATT&amp;CK]</td>\n",
       "      <td>[{'name': 'service creation', 'type': 'activit...</td>\n",
       "      <td>[https://docs.microsoft.com/en-us/dotnet/frame...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>Module</td>\n",
       "      <td>Information about portable executable files, s...</td>\n",
       "      <td>[host]</td>\n",
       "      <td>[Windows]</td>\n",
       "      <td>[ATT&amp;CK]</td>\n",
       "      <td>[{'name': 'module load', 'type': 'activity', '...</td>\n",
       "      <td>[https://docs.microsoft.com/en-us/windows/win3...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>WMI object</td>\n",
       "      <td>Information about objects from the system clas...</td>\n",
       "      <td>[host]</td>\n",
       "      <td>[Windows]</td>\n",
       "      <td>[ATT&amp;CK]</td>\n",
       "      <td>[{'name': 'wmi object context', 'type': 'infor...</td>\n",
       "      <td>[https://docs.microsoft.com/en-us/windows/win3...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>File</td>\n",
       "      <td>Information about file objects that represent ...</td>\n",
       "      <td>[host]</td>\n",
       "      <td>[Windows]</td>\n",
       "      <td>[ATT&amp;CK]</td>\n",
       "      <td>[{'name': 'file creation', 'type': 'activity',...</td>\n",
       "      <td>[https://docs.microsoft.com/en-us/windows/win3...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>Named pipe</td>\n",
       "      <td>Information about mechanisms that allow inter-...</td>\n",
       "      <td>[host]</td>\n",
       "      <td>[Windows]</td>\n",
       "      <td>[ATT&amp;CK]</td>\n",
       "      <td>[{'name': 'named pipe creation', 'relationship...</td>\n",
       "      <td>[https://docs.microsoft.com/en-us/windows/win3...</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "         name                                         definition  \\\n",
       "0     Service  Information about software programs that run i...   \n",
       "1      Module  Information about portable executable files, s...   \n",
       "2  WMI object  Information about objects from the system clas...   \n",
       "3        File  Information about file objects that represent ...   \n",
       "4  Named pipe  Information about mechanisms that allow inter-...   \n",
       "\n",
       "  collection_layers  platforms contributors  \\\n",
       "0            [host]  [Windows]     [ATT&CK]   \n",
       "1            [host]  [Windows]     [ATT&CK]   \n",
       "2            [host]  [Windows]     [ATT&CK]   \n",
       "3            [host]  [Windows]     [ATT&CK]   \n",
       "4            [host]  [Windows]     [ATT&CK]   \n",
       "\n",
       "                                     data_components  \\\n",
       "0  [{'name': 'service creation', 'type': 'activit...   \n",
       "1  [{'name': 'module load', 'type': 'activity', '...   \n",
       "2  [{'name': 'wmi object context', 'type': 'infor...   \n",
       "3  [{'name': 'file creation', 'type': 'activity',...   \n",
       "4  [{'name': 'named pipe creation', 'relationship...   \n",
       "\n",
       "                                          references  \n",
       "0  [https://docs.microsoft.com/en-us/dotnet/frame...  \n",
       "1  [https://docs.microsoft.com/en-us/windows/win3...  \n",
       "2  [https://docs.microsoft.com/en-us/windows/win3...  \n",
       "3  [https://docs.microsoft.com/en-us/windows/win3...  \n",
       "4  [https://docs.microsoft.com/en-us/windows/win3...  "
      ]
     },
     "execution_count": 5,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "filePath = 'attack_data_sources.yaml'\n",
    "yamlFile = open(filePath, 'r')\n",
    "metadata = yaml.safe_load(yamlFile)\n",
    "metadata = json_normalize(metadata)\n",
    "yamlFile.close()\n",
    "metadata.head()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Splitting data components content"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>data_components</th>\n",
       "      <th>type</th>\n",
       "      <th>data_sources</th>\n",
       "      <th>definition</th>\n",
       "      <th>collection_layers</th>\n",
       "      <th>platforms</th>\n",
       "      <th>contributors</th>\n",
       "      <th>references</th>\n",
       "      <th>relationships</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>service creation</td>\n",
       "      <td>activity</td>\n",
       "      <td>Service</td>\n",
       "      <td>Information about software programs that run i...</td>\n",
       "      <td>[host]</td>\n",
       "      <td>[Windows]</td>\n",
       "      <td>[ATT&amp;CK]</td>\n",
       "      <td>[https://docs.microsoft.com/en-us/dotnet/frame...</td>\n",
       "      <td>user-created-service</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>module load</td>\n",
       "      <td>activity</td>\n",
       "      <td>Module</td>\n",
       "      <td>Information about portable executable files, s...</td>\n",
       "      <td>[host]</td>\n",
       "      <td>[Windows]</td>\n",
       "      <td>[ATT&amp;CK]</td>\n",
       "      <td>[https://docs.microsoft.com/en-us/windows/win3...</td>\n",
       "      <td>process-loaded-dll</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>module load</td>\n",
       "      <td>activity</td>\n",
       "      <td>Module</td>\n",
       "      <td>Information about portable executable files, s...</td>\n",
       "      <td>[host]</td>\n",
       "      <td>[Windows]</td>\n",
       "      <td>[ATT&amp;CK]</td>\n",
       "      <td>[https://docs.microsoft.com/en-us/windows/win3...</td>\n",
       "      <td>process-loaded-executable</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>wmi object context</td>\n",
       "      <td>information</td>\n",
       "      <td>WMI object</td>\n",
       "      <td>Information about objects from the system clas...</td>\n",
       "      <td>[host]</td>\n",
       "      <td>[Windows]</td>\n",
       "      <td>[ATT&amp;CK]</td>\n",
       "      <td>[https://docs.microsoft.com/en-us/windows/win3...</td>\n",
       "      <td>wmi subscription-created-</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>wmi object creation</td>\n",
       "      <td>activity</td>\n",
       "      <td>WMI object</td>\n",
       "      <td>Information about objects from the system clas...</td>\n",
       "      <td>[host]</td>\n",
       "      <td>[Windows]</td>\n",
       "      <td>[ATT&amp;CK]</td>\n",
       "      <td>[https://docs.microsoft.com/en-us/windows/win3...</td>\n",
       "      <td>user-created-wmi filter</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "       data_components         type data_sources  \\\n",
       "0     service creation     activity      Service   \n",
       "1          module load     activity       Module   \n",
       "2          module load     activity       Module   \n",
       "3   wmi object context  information   WMI object   \n",
       "4  wmi object creation     activity   WMI object   \n",
       "\n",
       "                                          definition collection_layers  \\\n",
       "0  Information about software programs that run i...            [host]   \n",
       "1  Information about portable executable files, s...            [host]   \n",
       "2  Information about portable executable files, s...            [host]   \n",
       "3  Information about objects from the system clas...            [host]   \n",
       "4  Information about objects from the system clas...            [host]   \n",
       "\n",
       "   platforms contributors                                         references  \\\n",
       "0  [Windows]     [ATT&CK]  [https://docs.microsoft.com/en-us/dotnet/frame...   \n",
       "1  [Windows]     [ATT&CK]  [https://docs.microsoft.com/en-us/windows/win3...   \n",
       "2  [Windows]     [ATT&CK]  [https://docs.microsoft.com/en-us/windows/win3...   \n",
       "3  [Windows]     [ATT&CK]  [https://docs.microsoft.com/en-us/windows/win3...   \n",
       "4  [Windows]     [ATT&CK]  [https://docs.microsoft.com/en-us/windows/win3...   \n",
       "\n",
       "                relationships  \n",
       "0        user-created-service  \n",
       "1          process-loaded-dll  \n",
       "2   process-loaded-executable  \n",
       "3  wmi subscription-created-   \n",
       "4     user-created-wmi filter  "
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Splitting rows for data_components list\n",
    "metadata = metadata.explode('data_components').reset_index(drop=True).rename(columns={'name':'data_sources'})\n",
    "\n",
    "# Splitting columns for data_components dict\n",
    "metadata = metadata['data_components'].apply(pd.Series).merge(metadata,left_index=True,right_index=True)\\\n",
    ".reset_index(drop=True).drop(['data_components'], axis = 1).rename(columns={'name':'data_components'})\n",
    "\n",
    "# Splitting rows for relationships list\n",
    "metadata = metadata.explode('relationships').reset_index(drop=True)\n",
    "\n",
    "# Splitting columns for relationships dict\n",
    "metadata = metadata['relationships'].apply(pd.Series).merge(metadata,left_index=True,right_index=True)\\\n",
    ".reset_index(drop=True).drop(['relationships'], axis = 1)\n",
    "\n",
    "# Replacing Null values in target_data_element\n",
    "metadata['target_data_element'].fillna(' ', inplace = True)\n",
    "\n",
    "# Concatenating: Source + Relationship + Target\n",
    "metadata['relationships'] = metadata['source_data_element']+'-'+metadata['relationship']+'-'+\\\n",
    "                            metadata['target_data_element']\n",
    "\n",
    "# Deleting columns\n",
    "dataSources = metadata.drop(['source_data_element','relationship','target_data_element'], axis = 1)\n",
    "\n",
    "dataSources.head()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Third: Mapping (sub)techniques to data components & relationships"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Getting new data sources names"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "According to the propossed methodoly, data sources names shoud make reference to the main data element they are related. Because of this, some of the current names might change. Therefore, in order to relate **(sub)techniques** to **data components**, we need update data sources names. We are providing a yaml file with data sources which names have been changed. We will use this file to update the content of our data frame."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>data_sources</th>\n",
       "      <th>new_names</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>Sensor health and status</td>\n",
       "      <td>Sensor log</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>Access tokens</td>\n",
       "      <td>Access token</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>PowerShell logs</td>\n",
       "      <td>Powershell log</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>API monitoring</td>\n",
       "      <td>API</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>Application logs</td>\n",
       "      <td>Application log</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "               data_sources        new_names\n",
       "0  Sensor health and status       Sensor log\n",
       "1             Access tokens     Access token\n",
       "2           PowerShell logs   Powershell log\n",
       "3            API monitoring              API\n",
       "4          Application logs  Application log"
      ]
     },
     "execution_count": 7,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "namesPath = 'new_data_sources_names.yaml'\n",
    "yamlNamesFile = open(namesPath, 'r')\n",
    "names = yaml.safe_load(yamlNamesFile)\n",
    "yamlNamesFile.close()\n",
    "names = pd.DataFrame(list(names[0].items()), columns=['data_sources', 'new_names'])\n",
    "names.head()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Updating data sources names"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>tactic</th>\n",
       "      <th>technique_id</th>\n",
       "      <th>technique</th>\n",
       "      <th>data_sources</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>[privilege-escalation, defense-evasion]</td>\n",
       "      <td>T1548</td>\n",
       "      <td>Abuse Elevation Control Mechanism</td>\n",
       "      <td>API</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>[privilege-escalation, defense-evasion]</td>\n",
       "      <td>T1548</td>\n",
       "      <td>Abuse Elevation Control Mechanism</td>\n",
       "      <td>Process</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>[privilege-escalation, defense-evasion]</td>\n",
       "      <td>T1548</td>\n",
       "      <td>Abuse Elevation Control Mechanism</td>\n",
       "      <td>File</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>[privilege-escalation, defense-evasion]</td>\n",
       "      <td>T1548</td>\n",
       "      <td>Abuse Elevation Control Mechanism</td>\n",
       "      <td>Windows registry</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>[defense-evasion, privilege-escalation]</td>\n",
       "      <td>T1134</td>\n",
       "      <td>Access Token Manipulation</td>\n",
       "      <td>Process</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                                    tactic technique_id  \\\n",
       "0  [privilege-escalation, defense-evasion]        T1548   \n",
       "1  [privilege-escalation, defense-evasion]        T1548   \n",
       "2  [privilege-escalation, defense-evasion]        T1548   \n",
       "3  [privilege-escalation, defense-evasion]        T1548   \n",
       "4  [defense-evasion, privilege-escalation]        T1134   \n",
       "\n",
       "                           technique      data_sources  \n",
       "0  Abuse Elevation Control Mechanism               API  \n",
       "1  Abuse Elevation Control Mechanism           Process  \n",
       "2  Abuse Elevation Control Mechanism              File  \n",
       "3  Abuse Elevation Control Mechanism  Windows registry  \n",
       "4          Access Token Manipulation           Process  "
      ]
     },
     "execution_count": 8,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "attck = pd.merge(attck, names, on = 'data_sources', how = 'left')\n",
    "namesUpdate = attck['new_names'].fillna(attck['data_sources'])\n",
    "attck = attck.drop(columns = ['new_names']).assign(data_sources = namesUpdate)\n",
    "attck = attck.drop_duplicates(subset = ['technique_id','data_sources'])\\\n",
    "        .sort_values(by = ['technique'])\\\n",
    "        .reset_index(drop = True)\n",
    "attck.head()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Mapping techniques to data components and relationships"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>tactic</th>\n",
       "      <th>technique_id</th>\n",
       "      <th>technique</th>\n",
       "      <th>data_sources</th>\n",
       "      <th>data_components</th>\n",
       "      <th>relationships</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>[privilege-escalation, defense-evasion]</td>\n",
       "      <td>T1548</td>\n",
       "      <td>Abuse Elevation Control Mechanism</td>\n",
       "      <td>API</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>[privilege-escalation, defense-evasion]</td>\n",
       "      <td>T1548</td>\n",
       "      <td>Abuse Elevation Control Mechanism</td>\n",
       "      <td>Process</td>\n",
       "      <td>process creation</td>\n",
       "      <td>user-created-process</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>[privilege-escalation, defense-evasion]</td>\n",
       "      <td>T1548</td>\n",
       "      <td>Abuse Elevation Control Mechanism</td>\n",
       "      <td>Process</td>\n",
       "      <td>process creation</td>\n",
       "      <td>process-created-process</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>[privilege-escalation, defense-evasion]</td>\n",
       "      <td>T1548</td>\n",
       "      <td>Abuse Elevation Control Mechanism</td>\n",
       "      <td>Process</td>\n",
       "      <td>process modification</td>\n",
       "      <td>process-wrote to-process</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>[privilege-escalation, defense-evasion]</td>\n",
       "      <td>T1548</td>\n",
       "      <td>Abuse Elevation Control Mechanism</td>\n",
       "      <td>Process</td>\n",
       "      <td>process access</td>\n",
       "      <td>process-accessed-process</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                                    tactic technique_id  \\\n",
       "0  [privilege-escalation, defense-evasion]        T1548   \n",
       "1  [privilege-escalation, defense-evasion]        T1548   \n",
       "2  [privilege-escalation, defense-evasion]        T1548   \n",
       "3  [privilege-escalation, defense-evasion]        T1548   \n",
       "4  [privilege-escalation, defense-evasion]        T1548   \n",
       "\n",
       "                           technique data_sources       data_components  \\\n",
       "0  Abuse Elevation Control Mechanism          API                   NaN   \n",
       "1  Abuse Elevation Control Mechanism      Process      process creation   \n",
       "2  Abuse Elevation Control Mechanism      Process      process creation   \n",
       "3  Abuse Elevation Control Mechanism      Process  process modification   \n",
       "4  Abuse Elevation Control Mechanism      Process        process access   \n",
       "\n",
       "              relationships  \n",
       "0                       NaN  \n",
       "1      user-created-process  \n",
       "2   process-created-process  \n",
       "3  process-wrote to-process  \n",
       "4  process-accessed-process  "
      ]
     },
     "execution_count": 9,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "techniques = pd.merge(attck, dataSources, on = 'data_sources', how = 'left')\\\n",
    "             [['tactic','technique_id','technique','data_sources','data_components','relationships']]\n",
    "\n",
    "techniques.head()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Use case: T1112 Modify Registry"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* What are the recommended data sources?"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>tactic</th>\n",
       "      <th>technique_id</th>\n",
       "      <th>technique</th>\n",
       "      <th>data_sources</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>635</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Process</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>636</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Windows registry</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>637</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>File</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>638</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Windows event logs</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                tactic technique_id        technique        data_sources\n",
       "635  [defense-evasion]        T1112  Modify Registry             Process\n",
       "636  [defense-evasion]        T1112  Modify Registry    Windows registry\n",
       "637  [defense-evasion]        T1112  Modify Registry                File\n",
       "638  [defense-evasion]        T1112  Modify Registry  Windows event logs"
      ]
     },
     "execution_count": 10,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "attck[attck['technique_id'] == 'T1112']"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* What are the available data components and relationships?"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>tactic</th>\n",
       "      <th>technique_id</th>\n",
       "      <th>technique</th>\n",
       "      <th>data_sources</th>\n",
       "      <th>data_components</th>\n",
       "      <th>relationships</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>3901</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Process</td>\n",
       "      <td>process creation</td>\n",
       "      <td>user-created-process</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3902</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Process</td>\n",
       "      <td>process creation</td>\n",
       "      <td>process-created-process</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3903</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Process</td>\n",
       "      <td>process modification</td>\n",
       "      <td>process-wrote to-process</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3904</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Process</td>\n",
       "      <td>process access</td>\n",
       "      <td>process-accessed-process</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3905</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Process</td>\n",
       "      <td>process access</td>\n",
       "      <td>process-requested access-process</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3906</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Process</td>\n",
       "      <td>process network connection</td>\n",
       "      <td>process-connected to-port</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3907</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Process</td>\n",
       "      <td>process network connection</td>\n",
       "      <td>process-connected to-ip</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3908</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Process</td>\n",
       "      <td>process network connection</td>\n",
       "      <td>process-connected to-host</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3909</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Process</td>\n",
       "      <td>process network connection</td>\n",
       "      <td>process-connected from-port</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3910</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Process</td>\n",
       "      <td>process network connection</td>\n",
       "      <td>process-connected from-ip</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3911</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Process</td>\n",
       "      <td>process network connection</td>\n",
       "      <td>process-connected from-host</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3912</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Process</td>\n",
       "      <td>process network connection</td>\n",
       "      <td>user-connected to-port</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3913</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Process</td>\n",
       "      <td>process network connection</td>\n",
       "      <td>user-connected to-ip</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3914</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Process</td>\n",
       "      <td>process network connection</td>\n",
       "      <td>user-connected to-host</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3915</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Process</td>\n",
       "      <td>process network connection</td>\n",
       "      <td>user-connected from-port</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3916</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Process</td>\n",
       "      <td>process network connection</td>\n",
       "      <td>user-connected from-ip</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3917</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Process</td>\n",
       "      <td>process network connection</td>\n",
       "      <td>user-connected from-host</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3918</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Windows registry</td>\n",
       "      <td>windows registry key creation</td>\n",
       "      <td>process-creted-windows registry key</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3919</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Windows registry</td>\n",
       "      <td>windows registry key creation</td>\n",
       "      <td>process-creted-windows registry key value</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3920</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Windows registry</td>\n",
       "      <td>windows registry key deletion</td>\n",
       "      <td>process-deleted-windows registry key</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3921</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Windows registry</td>\n",
       "      <td>windows registry key deletion</td>\n",
       "      <td>process-deleted-windows registry key value</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3922</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Windows registry</td>\n",
       "      <td>windows registry key modification</td>\n",
       "      <td>process-modified-windows registry key</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3923</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Windows registry</td>\n",
       "      <td>windows registry key modification</td>\n",
       "      <td>process-modified-windows registry key value</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3924</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Windows registry</td>\n",
       "      <td>windows registry key modification</td>\n",
       "      <td>user-modified-windows registry key value</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3925</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Windows registry</td>\n",
       "      <td>Windows registry key access</td>\n",
       "      <td>process-accessed-windows registry key</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3926</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Windows registry</td>\n",
       "      <td>Windows registry key access</td>\n",
       "      <td>user-accessed-windows registry key</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3927</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Windows registry</td>\n",
       "      <td>Windows registry key access</td>\n",
       "      <td>process-requested access-windows registry key</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3928</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Windows registry</td>\n",
       "      <td>Windows registry key access</td>\n",
       "      <td>user-requested access-windows registry key</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3929</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>File</td>\n",
       "      <td>file creation</td>\n",
       "      <td>process-created-file</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3930</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>File</td>\n",
       "      <td>file deletion</td>\n",
       "      <td>process-deleted-file</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3931</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>File</td>\n",
       "      <td>file access</td>\n",
       "      <td>user-accessed-file</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3932</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>File</td>\n",
       "      <td>file access</td>\n",
       "      <td>process-accessed-file</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3933</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>File</td>\n",
       "      <td>file access</td>\n",
       "      <td>user-requested access-file</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3934</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>File</td>\n",
       "      <td>file access</td>\n",
       "      <td>process-requested access-file</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3935</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>File</td>\n",
       "      <td>file share access</td>\n",
       "      <td>user-accessed-file share</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3936</th>\n",
       "      <td>[defense-evasion]</td>\n",
       "      <td>T1112</td>\n",
       "      <td>Modify Registry</td>\n",
       "      <td>Windows event logs</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                 tactic technique_id        technique        data_sources  \\\n",
       "3901  [defense-evasion]        T1112  Modify Registry             Process   \n",
       "3902  [defense-evasion]        T1112  Modify Registry             Process   \n",
       "3903  [defense-evasion]        T1112  Modify Registry             Process   \n",
       "3904  [defense-evasion]        T1112  Modify Registry             Process   \n",
       "3905  [defense-evasion]        T1112  Modify Registry             Process   \n",
       "3906  [defense-evasion]        T1112  Modify Registry             Process   \n",
       "3907  [defense-evasion]        T1112  Modify Registry             Process   \n",
       "3908  [defense-evasion]        T1112  Modify Registry             Process   \n",
       "3909  [defense-evasion]        T1112  Modify Registry             Process   \n",
       "3910  [defense-evasion]        T1112  Modify Registry             Process   \n",
       "3911  [defense-evasion]        T1112  Modify Registry             Process   \n",
       "3912  [defense-evasion]        T1112  Modify Registry             Process   \n",
       "3913  [defense-evasion]        T1112  Modify Registry             Process   \n",
       "3914  [defense-evasion]        T1112  Modify Registry             Process   \n",
       "3915  [defense-evasion]        T1112  Modify Registry             Process   \n",
       "3916  [defense-evasion]        T1112  Modify Registry             Process   \n",
       "3917  [defense-evasion]        T1112  Modify Registry             Process   \n",
       "3918  [defense-evasion]        T1112  Modify Registry    Windows registry   \n",
       "3919  [defense-evasion]        T1112  Modify Registry    Windows registry   \n",
       "3920  [defense-evasion]        T1112  Modify Registry    Windows registry   \n",
       "3921  [defense-evasion]        T1112  Modify Registry    Windows registry   \n",
       "3922  [defense-evasion]        T1112  Modify Registry    Windows registry   \n",
       "3923  [defense-evasion]        T1112  Modify Registry    Windows registry   \n",
       "3924  [defense-evasion]        T1112  Modify Registry    Windows registry   \n",
       "3925  [defense-evasion]        T1112  Modify Registry    Windows registry   \n",
       "3926  [defense-evasion]        T1112  Modify Registry    Windows registry   \n",
       "3927  [defense-evasion]        T1112  Modify Registry    Windows registry   \n",
       "3928  [defense-evasion]        T1112  Modify Registry    Windows registry   \n",
       "3929  [defense-evasion]        T1112  Modify Registry                File   \n",
       "3930  [defense-evasion]        T1112  Modify Registry                File   \n",
       "3931  [defense-evasion]        T1112  Modify Registry                File   \n",
       "3932  [defense-evasion]        T1112  Modify Registry                File   \n",
       "3933  [defense-evasion]        T1112  Modify Registry                File   \n",
       "3934  [defense-evasion]        T1112  Modify Registry                File   \n",
       "3935  [defense-evasion]        T1112  Modify Registry                File   \n",
       "3936  [defense-evasion]        T1112  Modify Registry  Windows event logs   \n",
       "\n",
       "                        data_components  \\\n",
       "3901                   process creation   \n",
       "3902                   process creation   \n",
       "3903               process modification   \n",
       "3904                     process access   \n",
       "3905                     process access   \n",
       "3906         process network connection   \n",
       "3907         process network connection   \n",
       "3908         process network connection   \n",
       "3909         process network connection   \n",
       "3910         process network connection   \n",
       "3911         process network connection   \n",
       "3912         process network connection   \n",
       "3913         process network connection   \n",
       "3914         process network connection   \n",
       "3915         process network connection   \n",
       "3916         process network connection   \n",
       "3917         process network connection   \n",
       "3918      windows registry key creation   \n",
       "3919      windows registry key creation   \n",
       "3920      windows registry key deletion   \n",
       "3921      windows registry key deletion   \n",
       "3922  windows registry key modification   \n",
       "3923  windows registry key modification   \n",
       "3924  windows registry key modification   \n",
       "3925        Windows registry key access   \n",
       "3926        Windows registry key access   \n",
       "3927        Windows registry key access   \n",
       "3928        Windows registry key access   \n",
       "3929                      file creation   \n",
       "3930                      file deletion   \n",
       "3931                        file access   \n",
       "3932                        file access   \n",
       "3933                        file access   \n",
       "3934                        file access   \n",
       "3935                  file share access   \n",
       "3936                                NaN   \n",
       "\n",
       "                                      relationships  \n",
       "3901                           user-created-process  \n",
       "3902                        process-created-process  \n",
       "3903                       process-wrote to-process  \n",
       "3904                       process-accessed-process  \n",
       "3905               process-requested access-process  \n",
       "3906                      process-connected to-port  \n",
       "3907                        process-connected to-ip  \n",
       "3908                      process-connected to-host  \n",
       "3909                    process-connected from-port  \n",
       "3910                      process-connected from-ip  \n",
       "3911                    process-connected from-host  \n",
       "3912                         user-connected to-port  \n",
       "3913                           user-connected to-ip  \n",
       "3914                         user-connected to-host  \n",
       "3915                       user-connected from-port  \n",
       "3916                         user-connected from-ip  \n",
       "3917                       user-connected from-host  \n",
       "3918            process-creted-windows registry key  \n",
       "3919      process-creted-windows registry key value  \n",
       "3920           process-deleted-windows registry key  \n",
       "3921     process-deleted-windows registry key value  \n",
       "3922          process-modified-windows registry key  \n",
       "3923    process-modified-windows registry key value  \n",
       "3924       user-modified-windows registry key value  \n",
       "3925          process-accessed-windows registry key  \n",
       "3926             user-accessed-windows registry key  \n",
       "3927  process-requested access-windows registry key  \n",
       "3928     user-requested access-windows registry key  \n",
       "3929                           process-created-file  \n",
       "3930                           process-deleted-file  \n",
       "3931                             user-accessed-file  \n",
       "3932                          process-accessed-file  \n",
       "3933                     user-requested access-file  \n",
       "3934                  process-requested access-file  \n",
       "3935                       user-accessed-file share  \n",
       "3936                                            NaN  "
      ]
     },
     "execution_count": 11,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "techniques[techniques['technique_id'] == 'T1112']"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Thank you :)"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.6"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}