feat(convert): export DIMA en galaxy MISP#42
Open
sebdraven wants to merge 3 commits into
Open
Conversation
Adds an md2misp subcommand to dima_convert that turns the four phase files into a MISP-compatible galaxy+cluster pair: - misp/galaxies/dima.json -- galaxy descriptor (fixed UUID) - misp/clusters/dima.json -- one entry per TA and TE Each value carries the original ID in meta.external_id, the phase, and for techniques the parent tactic, plus a related[] link to that tactic (subtechnique-of). URLs extracted from descriptions and sections become meta.refs. All UUIDs are derived via uuid5 from a fixed namespace so a re-run produces byte-identical output. The bundled misp/ output (17 TA, 44 TE) was generated from the current markdown so MISP users can import it as-is. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds a MISP-galaxy workflow that regenerates the cluster+galaxy pair
into a scratch directory on every PR and push to main and diffs it
against the committed misp/ tree. If the two differ, the job fails
with a message telling the contributor to run
uv run src/dima_convert.py md2misp -o misp
and commit the result. JSON parse-ability of both output files is also
checked.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
When the script ran on Windows, Path.write_text translated each \n to \r\n via the universal-newlines text-mode default, so the committed misp/ tree carried CRLF endings while a Linux regeneration produced LF. The new misp sync-check workflow caught this on its first run. Introduces a _write_text helper that opens the target with newline="\n" and routes all generated outputs (md_to_json, json_to_md, md2misp) through it. Regenerates misp/ on Windows to land an LF-only committed copy that matches what CI will produce. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
sebdraven
added a commit
that referenced
this pull request
May 15, 2026
PR #42 is still in review. Removes from the README the quick-start row, the dedicated MISP section, the md2misp command sample, the misp.yml CI row and the misp/ entry in the repo layout. They will be added back in a follow-up commit once #42 is merged. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
Fixed in https://github.com/MISP/misp-galaxy/blob/main/tools/gen_dima.py and now part of the official misp-galaxy. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Ajoute la sous-commande
md2mispau scriptdima_convert.pyqui produit une galaxy MISP importable, generee depuis les 4 fichiers markdown du repo.Sortie
Modele
type=tacticavecmeta.external_id,meta.phase.type=techniqueavecmeta.external_id,meta.phase,meta.tactic, et unrelated[]pointant vers l'UUID de sa tactique (subtechnique-of).meta.refs.uuid5(NAMESPACE, "dima:PHASE:ID")-> deterministes : une re-execution produit un fichier identique au bit pres.Contenu bundle
La generation
misp/est commise telle quelle pour les utilisateurs MISP : 17 tactiques, 44 techniques (cf. les 4 phases apres homogeneisation).Usage
Test plan
uv run pytest-> 27 passed (5 nouveaux tests MISP)misp/galaxies/dima.json+misp/clusters/dima.jsondans une instance MISP de testGenerated with Claude Code