Query Details

MITRE JSON Parser

Query

No standalone KQL detected in this source

About this query

Explanation

This query retrieves information from MITRE's Enterprise Attack json file and parses it into a format that can be used for analysis.

Details

Rod Trent

Released: April 30, 2024

Tables

MITRE

Keywords

ExternaldataObject_marking_refsIdTypeCreatedCreated_by_refExternal_referencesSource_nameUrlExternal_idModifiedNameDescriptionX_mitre_deprecatedX_mitre_versionX_mitre_modified_by_ref.

Operators

externaldatawithformatingestionMappinglet[ ]@"https://github.com/mitre/cti/blob/master/enterprise-attack/enterprise-attack.json"PathPropertiesColumn$.type$.id$.objects$.objects.x_mitre_domains$.objects.object_marking_refs$.objects.id$.objects.type$.objects.created$.objects.created_by_ref$.objects.external_references$.objects.external_references.source_name$.objects.external_references.url$.objects.external_references.external_id$.objects.modified$.objects.name$.objects.description$.objects.x_mitre_deprecated$.objects.x_mitre_version$.objects.x_mitre_modified_by_ref

Actions

GitHub