Threat Actor TTP CLI

Go ve SQLite ile yazilmis basit bir CLI uygulamasidir. Threat actor kayitlari ile MITRE ATT&CK TTP kayitlarini eslestirir.

Gereksinimler

• Go 1.25+

Calistirma

Varsayilan veritabani:

data/threat_actor.db

Komutlar:

go run . help
go run . seed
go run . actor list

Web arayuzunu baslatmak icin:

go run ./cmd/server

Arayuz varsayilan olarak su adreste acilir:

http://localhost:8080

Farkli veritabani kullanmak icin:

$env:APP_DB_PATH='data\\project.db'
go run . actor list

Web arayuzunde farkli adres veya port kullanmak icin:

$env:APP_ADDR=':8081'
go run ./cmd/server

Komutlar

Actor islemleri:

go run . actor add --name "APT29" --description "State-sponsored espionage group"
go run . actor update --id 1 --name "APT29" --description "Updated description"
go run . actor delete --id 1
go run . actor list

TTP islemleri:

go run . ttp add --technique-id T1059 --name "Command and Scripting Interpreter" --tactic Execution
go run . ttp update --technique-id T1059 --name "Command and Scripting Interpreter" --tactic Execution
go run . ttp delete --technique-id T1059
go run . ttp list

Iliski islemleri:

go run . relation link --actor-id 1 --technique-id T1059
go run . relation unlink --actor-id 1 --technique-id T1059
go run . relation list

Sorgular:

go run . query actor-ttps --actor-id 1
go run . query ttp-actors --technique-id T1059
go run . query search-technique --technique-id T10
go run . query filter-tactic --tactic Execution
go run . query explore --actor-id 1
go run . query explore --technique-id T1059

Schema yazdirmak icin:

go run . schema

Ornek Veri

Seed verisini yuklemek icin:

go run . seed

Seed icindeki actor kayitlari:

• APT29
• APT28
• Lazarus Group
• FIN7
• Sandworm Team

Seed icindeki TTP kayitlari:

• T1021
• T1053
• T1059
• T1078
• T1087
• T1110
• T1133
• T1486
• T1547
• T1560
• T1566

Seed komutu tekrar calistirilabilir. Mevcut kayitlari gunceller, eksik kayitlari ekler ve ayni iliskiyi ikinci kez olusturmaz.

Test

go test ./...
go vet ./...