sonar-update-rule-mitre-batch
Update the MITRE ATT&CK mapping of existing rules from input records.
Input record:
- guid (required) - Target rule GUID
- source (optional) - STREAM or BATCH. STREAM unless given
- mitre_tactics (optional) - MITRE tactic IDs in TA0011 form - a list, or a space- or comma-separated string
- mitre_techs (optional) - MITRE technique IDs in T1071.001 form - a list, or a space- or comma-separated string
At least one of mitre_tactics and mitre_techs is required. A field that is not given is left unchanged, and an empty list clears that mapping.
sonar-update-rule-mitre-batch [run=VALUE]
- run=VALUE
- Optional. Update rule only if value is 't'
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| _status | String | Status | e.g. success. One of success (written), applicable (checks passed but run=t was not given, so nothing was written), or failure - see _error |
| _error | String | Error | e.g. Stream rule not found. Reason the record was rejected |
| _warning | String | Warning | e.g. unresolved technique ids: T9999. Applied, but not everything the record asked for |