@@ -41,35 +41,31 @@ If you choose the "Technical" (payloads) simulation type, you will also need to
41
41
42
42
It’s essential to understand that a scenario creation for these entities relies on matching TTPs between OpenCTI and
43
43
OpenBAS. You’ll need to ensure that the TTPs in both platforms are aligned. For instance, if your report contains the
44
- TTP T1059.001, a scenario can be created with an inject, provided OpenBAS also includes T1059.001.
44
+ TTP T1059.001, a scenario can be created with an inject, provided OpenBAS also includes T1059.001. Otherwise, an
45
+ inject with a placeholder will be created instead for this TTP.
45
46
46
47
If these TTPs are not supported by OpenBAS, you will receive an alert listing the uncovered TTPs.
47
48
48
49
![ ttps not covered obas] ( assets/octi-ttps-no-covered.png )
49
50
50
- When generating a scenario from OpenCTI, a scenario is created and can be accessed from the scenarios screen. The
51
+ When generating a scenario from OpenCTI, a scenario is created on OpenBas and can be accessed from the scenarios screen. The
51
52
scenario name will include a reference to OpenCTI, indicating its origin. This scenario will automatically contain
52
53
relevant sequences of injects based on the threat context identified in OpenCTI.
53
54
55
+ ![ Scenario OpenBAS] ( assets/scenario-openbas.png )
56
+
57
+ ![ Scenario OpenBAS] ( assets/inject-scenario-openbas.png )
58
+
59
+ ![ Scenario OpenBAS] ( assets/inject-placeholder.png )
60
+
54
61
However, it's important to review and potentially customize the scenario to ensure it meets your organization's specific
55
62
requirements. Additionally, you'll need to select appropriate [ targets] ( ../targets.md ) for the injects within the
56
63
scenario.
57
64
65
+ ![ Scenario OpenBAS] ( assets/inject-ttp.png )
66
+
58
67
Once you've finalized the scenario, you can schedule your simulation as you would do for any other scenarios. The overall
59
68
results of the simulation will also be available directly within OpenCTI, providing insights into the threat context
60
69
upon which the scenario is based.
61
70
62
71
![ Simulate results] ( assets/simulate-result.png )
63
-
64
- Exemple of a scenario generated on OpenBAS is:
65
-
66
- ![ Scenario OpenBAS] ( assets/scenario-openbas.png )
67
-
68
- Here, you can see the list of injects generated for ttp existents on openBAS, exemples of injects placeholder and existents :
69
-
70
- ![ Scenario OpenBAS] ( assets/inject-scenario-openbas.png )
71
-
72
- ![ Scenario OpenBAS] ( assets/inject-placeholder.png )
73
-
74
- ![ Scenario OpenBAS] ( assets/inject-ttp.png )
75
-
0 commit comments