Skip to content

chore: refresh the shipped datasets - #7

Merged
pakdekro merged 2 commits into
mainfrom
chore/datasets-refresh
Sep 7, 2026
Merged

chore: refresh the shipped datasets#7
pakdekro merged 2 commits into
mainfrom
chore/datasets-refresh

Conversation

@github-actions

@github-actions github-actions Bot commented Aug 17, 2026

Copy link
Copy Markdown

Weekly regeneration of the corpora committed under
frontend/public/. What the build scripts reported:

ATT&CK v19.2 : {'attack-pattern': 918, 'intrusion-set': 180, 'malware': 856, 'tool': 97} -> attack-dataset.json (166 Ko)
  enterprise +1698 (v19.2), mobile +248 (v19.2), ics +105 (v19.2)
F3 v1.1 : 123 techniques (43 ATT&CK, 80 F3), 8 tactics -> f3-dataset.json (17 Ko)
  read from f3-v1.1.json, the most recent published native file
  16 names taken back from ATT&CK (F3 spells sub-techniques by full path)
  flagged isAttack but absent from our Enterprise dataset, F3 spelling kept:
    T1586.004 (Compromise Accounts: Corporate Accounts)
    T1672 (Email Spoofing)
ATLAS 2026.08 : 197 techniques (83 sub-techniques), 16 tactics -> atlas-dataset.json (36 Ko)
  read from dist/v6/ATLAS-2026.08.yaml, reached by following MITRE's own pointers
  42 adapt an ATT&CK technique, and keep their own identifier
  left out: 39 mitigations (course-of-action) and 72 case studies (no STIX object)
AADAPT : 68 techniques (34 sub-techniques), 11 tactics -> aadapt-dataset.json (11 Ko)
  10 of the tactics ARE ATT&CK tactics, 1 is its own
  4 techniques adapt an ATT&CK technique, and keep their own number
  no version published: the 4.4.0 in the file is ATLAS's, inherited by the fork
/home/runner/work/DrawMeAStix/DrawMeAStix/frontend/public/actors-dataset.json: 861 actors
  dropped, ATT&CK already resolves them : 186
  dropped, placeholders naming nobody   : 3
  merged, duplicated inside the galaxy  : 0
  synonyms dropped as contested         : 20
/home/runner/work/DrawMeAStix/DrawMeAStix/frontend/public/countries.json: 249 countries

Worth reading the diff for, rather than merging blind: a name that
moves between the two actor corpora changes which spelling
analysts are offered, and therefore which identifier their objects
get.

The frontend tests FAILED against these files. Something written down beside the datasets no longer agrees with them: a name arbitration, or a number in the framework pages. The run log says which. Fix it on this branch rather than merging.

@github-actions
github-actions Bot force-pushed the chore/datasets-refresh branch from 4e3609c to df561a6 Compare August 24, 2026 05:54
@github-actions
github-actions Bot force-pushed the chore/datasets-refresh branch from df561a6 to 2914fa6 Compare September 7, 2026 10:19
The weekly refresh brought a release that moves things the prose had
written down. AML.TA0001 is no longer "AI Attack Staging" but "AI Attack
Adaptation", and MITRE moved it from twelfth to third, before Initial
Access: it is now what you shape before you are in the environment, and
keep reshaping while the attack runs. The five techniques it gains say
why, three of them about an agent adjusting its own path.

The counts move with it. 178 techniques become 197, the ones adapting an
ATT&CK technique 37 become 42, and the names shared with ATT&CK 36 become
41. Each of those is stated in prose somewhere and asserted by a test,
which is what turned a dataset bump into a red run.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EZKZRDMVAdrWUQP2crYVXH
@pakdekro
pakdekro merged commit 42ec055 into main Sep 7, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant