Research and Mapping Design for Attack Flow Support in Thread

[KadeMorton]

What it is

Initial research and design work to integrate MITRE's Attack Flow framework into Thread, including schema review and mapping of Thread’s data to Attack Flow concepts.

Why it matters

• Provides a foundation for visualizing and exporting TTP sequences in STIX 2.1 Attack Flow format.
• Ensures consistency with MITRE standards and reusability of our intelligence in external tooling.

Requirements

• Read and understand:
  • MITRE Attack Flow spec v1.1
  • Extension-Definition SDO
  • Sample bundles from the spec repository
• Deliver a short mapping document detailing how Thread’s internal fields map to:
  • attack-action
  • attack-asset
  • attack-operator
  • attack-condition
  • etc.
• Decide default sequencing logic:
  • ATT&CK tactic order > timestamp (if present) > manual override
• Identify any schema gaps and limitations in Attack Flow for our use case.
• Confirm compatibility and usage of the stix2 Python library for export.

Acceptance Criteria

• Mapping document completed and reviewed.
• Sequencing rule agreed and documented.
• List of schema gaps delivered.
• Confirmation that stix2 Python library can support our use case.