cloak2stix

cloak2stix is a small exporter that clones the upstream CLOAK repository, reads concealment-data.json through git history, and writes a STIX 2.1 bundle.

Usage

Setup

Install the required dependencies using:

# clone the latest code
git clone https://github.com/muchdogesec/cloak2stix
cd cloak2stix
# create a venv
python3 -m venv cloak2stix-venv
source cloak2stix-venv/bin/activate
# install requirements
pip3 install -r requirements.txt

Run

The current entrypoint is:

python run_cloak2stix.py

That is the only run command in the repo today. There are no CLI flags or subcommands.

What The Current Options Mean

There are no user-supplied options yet, so the behavior is controlled by fixed values in the code:

• run_cloak2stix.py is the launcher and immediately calls cloak2stix.main.main().
• REPO_URL points at the upstream CLOAK GitHub repository that gets cloned or pulled.
• outputs/ is the working directory created in the current repo root.
• outputs/cloak is where the CLOAK repository is stored locally.
• outputs/bundle is where the generated STIX bundle is written.
• cloak-bundle-v<yy.mm.dd>.json is the output filename format.
• The bundle version suffix comes from the commit date of the last processed CLOAK commit.
• The UUID namespace in cloak2stix/main.py is used to make generated IDs deterministic.
• The three raw GitHub URLs in fetch_external_objects() are support objects added to the bundle before generated CLOAK content.

What It Does

The exporter currently follows this flow:

1. Create outputs/ if it does not exist.
2. Load three external STIX objects from fixed URLs.
3. Clone or update the upstream CLOAK repository into outputs/cloak.
4. Walk the git history for concealment-data.json from oldest commit to newest.
5. Track when each object first appears and last changes.
6. Recursively build tactics, techniques, sub-techniques, procedures, and relationships.
7. Write a single STIX bundle to outputs/bundle/cloak-bundle-v<version>.json.

Important Current Limitation

cloak2stix/main.py now imports cleanly again, so python run_cloak2stix.py can execute the exporter path described above.

Output Shape

The generated bundle includes:

• fetched support objects
• a matrix object with all tactic refs
• tactic objects
• technique objects
• sub-technique objects
• procedure objects
• subtechnique-of relationships
• uses relationships from techniques to procedures
• x_mitre_domains = ["CLOAK"] on generated and fetched STIX objects

It does not currently build a collection object or Navigator-specific export split.