v1.3.0

Changes included:

• API documentation has been enabled via swagger
  • You can access the documentation after deploying at https://yourdeployedinstance.com/swagger
  • Swagger requires you to authorize with an api-key before executing any API calls
• API keys are now able to be restricted to individual assessments in addition to the existing restrictions on CRUD operations
• A bug was corrected in how the Node objects were initialized
• A bug was corrected that hid the title row (effective back button) when filtering on MITRE ATT&CK IDs while editing an event
• README documentation has been migrated and broken out into the Wiki section

#19
#1
#13
#6
#11

v1.2.2

• All APIs have been enabled.
  • This allows for full CRUD operations on the Assessments/Scenarios/Events/Templates collections.
• New Metrics API added to enable retrieving interesting data about ETM usage.
• APIs require API Key Authentication and Authorization.
  • Keys have permissions sets that restrict their privileges to only what is assigned to them.
  • Key management added to the Admin Dashboard UI.
• MITRE ATT&CK implementation has been refactored to make maintaining the project much easier.
  • To update the ATT&CK data, just download the relevant ICS/Mobile/Enterprise JSON data files from the MITRE GitHub repository, delete the corresponding JSON files in ETM, and load the application.
  • When the compiled data files are not found, they will be recompiled with the new MITRE provided data files.
• MITRE ATT&CK selection has been refactored as well.
  • Accordions were removed and have been replaced with a sliding sub-menu system.
  • This should increase usability/productivity/accuracy when selecting a technique to associate with a given event.
• Various bugs were identified and corrected.
• Breadcrumbs have been introduced into the three major workflows
• Event factor info helpers now include information regarding BLS methodologies for completing a threat scenario

v1.2

Changes in v1.2:

• Bug Fixes
  • Node description null references
  • Importing template without selecting one
  • HTML Threat Matrix export incorrect calculation of Severity and Pervasiveness value
  • Node titles in attack narrative graphs failed to render when a space was present at the beginning of the string
  • Not supplying category titles in threat trees caused many exceptions. Fixed by enforcing category titles.
• Philosophy Changes
  • Altered styling in event/template creation to better illustrate threat source characteristics being tied to the threat source as opposed to the event
  • Included extra BLS description for threat source info helper to explain this in better detail
• Features Implemented
  • User is able to filter on MITRE ATT&CK technique ID now in addition to the technique title when selecting techniques for an event/template
  • Data from the recent MITRE ATT&CK v10 update has been incorporated
  • Attack narrative graphs now include a button to switch between white/black text
  • Attack narrative graphs now include semi-transparent rounded rectangles behind the node titles to improve readability
  • Exported attack trees open in a new tab
  • The chosen MITRE ATT&CK technique is now displayed outside of the accordion when creating an event/template
  • Default categories/colors have been added to the threat tree initialization process that mimics the ATT&CK structure.

v1.1

• Includes an array of bugfixes and style tweaks
• Threat tree categories can be updated (add/delete/update) without starting over from scratch
• Attack Narrative graphs now utilize D3.js for graph generation
  • Allows for drag and drop placement of nodes
• Template packs (import/export)

v1.0

Adding V1.0