[REQUEST] Require at least one tactic to be specified for techniques in the ADM

[adpare]

The attack data model should enforce that at least one kill chain phase (or tactic) is always specified when validating final and complete ATT&CK techniques.

Related ATT&CK Workbench Frontend issue

[seansica]

kill_chain_phases is currently optional, but if the key is present, it must include at least one tactic:

So, just to confirm, are you suggesting that we should make kill_chain_phases required?

export const techniqueBaseSchema = attackBaseDomainObjectSchema
  .extend({

    kill_chain_phases: z.array(killChainPhaseSchema)
            .min(1)
            .optional() // <-- PROPOSAL TO REMOVE THIS?
            .meta({
      description:
        'Techniques are associated with Tactics through their `kill_chain_phases` property. When the `kill_chain_name` matches the domain (`mitre-attack`, `mitre-mobile-attack`, or `mitre-ics-attack`), the `phase_name` corresponds to the `x_mitre_shortname` of the associated `x-mitre-tactic` object.',
}),

For context, the STIX 2.1 spec shows kill_chain_phases as optional, so this would be a spec deviation.

@clemiller @jondricek - thoughts?

1. Is it permissible and/or realistic for a technique to exist (in Workbench or otherwise) without being associated with a tactic?
2. Do we want this additional constrain imposed on all ATT&CK techniques through the ATT&CK spec, or is this more at home in Workbench itself (either as a frontend check or a backend check)?

[jondricek]

Yes, this should be a noted deviation from the STIX spec. It is an ATT&CK requirement.

[github-actions]

🎉 This issue has been resolved in version 4.11.5 🎉

The release is available on:

• npm package (@next dist-tag)
• GitHub release

Your semantic-release bot 📦🚀