Documentation
¶
Overview ¶
Package attack maps PromptZero tools and workflows to MITRE ATT&CK techniques. The registry is intentionally a small, curated subset of MITRE's full catalog — just the techniques PromptZero's hardware surfaces can actually execute — rather than a wrapped copy of the entire matrix. Operators who need full MITRE reference material should consult attack.mitre.org; this package exists to give the agent's planner and the report generator a stable handle on which techniques each tool contributes to.
Design notes:
- Tool → technique mapping is N:M. wifi_sniff_pmkid produces both a network-sniffing signal (T1040) and a credential-grab signal (T1552.004), so both attach.
- Technique IDs follow MITRE's own notation (T1040, T1557.004). Sub-technique IDs carry a dot. Callers should treat them as opaque strings — never split.
- The built-in list is curated, not exhaustive. Add new techniques to builtinTechniques and new mappings to builtinToolMap as new tools land. Unknown tools return an empty slice rather than erroring, so this package never blocks a feature.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Index ¶
type Index struct {
// contains filtered or unexported fields
}
Index maps tool names to the ATT&CK techniques they contribute to. Lookups are cheap and lock-free after construction.
func NewDefaultIndex ¶
func NewDefaultIndex() *Index
NewDefaultIndex returns an Index bound to NewDefaultRegistry with the built-in tool → technique mapping installed. The typical entry point for the agent and report generator.
func NewIndex ¶
NewIndex builds an Index over the supplied Registry using the provided mapping. Unknown technique IDs in the mapping are silently dropped — logging them noisily at init time would wake operators up for a typo in a constant.
func (*Index) Registry ¶
Registry returns the underlying technique registry for lookups that need more than just the tool mapping.
func (*Index) Techniques ¶
Techniques returns every technique ID that has at least one tool tagged with it, sorted. The report generator uses this to compute coverage heatmaps without iterating every technique MITRE publishes.
func (*Index) TechniquesForTool ¶
TechniquesForTool returns the ATT&CK technique IDs associated with the given tool. Empty slice when the tool is untagged — callers should treat that as "no contribution to the coverage heatmap" rather than as an error.
func (*Index) ToolsForTechnique ¶
ToolsForTechnique returns the tool names tagged with a technique. Useful for a planner that wants to answer "which tools give me coverage on T1557.004?".
type Registry ¶
type Registry struct {
// contains filtered or unexported fields
}
Registry holds the known ATT&CK technique metadata. Safe for concurrent reads; Register is rarely called at runtime (typically just at package init from builtinTechniques).
func NewDefaultRegistry ¶
func NewDefaultRegistry() *Registry
NewDefaultRegistry returns a Registry populated with the curated set of ATT&CK techniques PromptZero's Flipper + Marauder tools can execute. Not exhaustive — operators running custom workflows can register additional techniques at setup time via Registry.Register.
func NewRegistry ¶
func NewRegistry() *Registry
NewRegistry returns an empty Registry. NewDefaultRegistry is the typical entry point for production code.
func (*Registry) Lookup ¶
Lookup returns the technique registered for the given ID, along with a found flag. Sub-technique IDs (with a dot) and parent IDs both resolve as long as they were registered.
func (*Registry) Register ¶
Register adds or replaces a technique entry. Technique IDs are unique; re-registering an ID overwrites.
func (*Registry) Tactics ¶
Tactics returns the sorted list of tactic names referenced by any registered technique. Useful for the report generator's heatmap column layout.
func (*Registry) TechniquesForTactic ¶
TechniquesForTactic returns technique IDs grouped under a tactic.
type Technique ¶
type Technique struct {
ID string `json:"id"` // "T1040", "T1557.004"
Name string `json:"name"` // "Network Sniffing"
Tactic string `json:"tactic"` // "Discovery", "Credential Access", ...
Parent string `json:"parent,omitempty"` // parent technique ID for sub-techniques
}
Technique is a compact ATT&CK technique descriptor. Tactic names follow MITRE's enterprise-matrix column headers (e.g. "Credential Access", "Discovery"). Parent is set for sub-techniques only (e.g. T1557.004 has Parent = "T1557").
Source Files