Skip to content

Conversation

@boazmichaely
Copy link

Description

This PR adds a new utility script for generating enriched CSV reports of ACS policies with human-readable MITRE ATT&CK information.

What it does

  • Exports ACS policies to CSV format (easy to analyze in Excel/Google Sheets)
  • Fetches the MITRE ATT&CK framework (577 tactic/technique mappings)
  • Enriches policy data with human-readable MITRE information
  • Provides tactics and techniques with descriptions, not just IDs

Why it's valuable

Complements existing export-all-policies tool:

  • export-all-policies: JSON format for policy backup/re-import
  • acs-rich-policy-report: CSV format for security analysis and reporting

Target audience: Security analysts, auditors, compliance teams who need to:

  • Review policy coverage against MITRE ATT&CK framework
  • Generate reports for leadership/compliance
  • Analyze policy effectiveness in spreadsheet tools

Example Output

The existing JSON export contains MITRE IDs only:

"mitreAttackVectors": [{"tactic": "TA0011", "techniques": ["T1105"]}]

This tool enriches with human-readable information:

Policy: Alpine Linux Package Manager Execution
MITRE Tactics: TA0011 (Command and Control)
MITRE Techniques: TA0011: T1105 (Ingress Tool Transfer)

Testing

Tested against ACS environment with 87 policies, successfully exported 34 policies with MITRE ATT&CK data.

This tool generates CSV reports of ACS policies with human-readable
MITRE ATT&CK tactics and techniques. Complements the existing
export-all-policies tool by providing enriched data for security
analysts and auditors.

Features:
- Exports policies to CSV format (vs JSON)
- Enriches with MITRE ATT&CK framework (577 mappings)
- Human-readable tactics and techniques (not just IDs)
- Easy analysis in spreadsheet tools
@github-actions github-actions bot added the external-contributor To add to issues and PRs from external contributors label Nov 26, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

external-contributor To add to issues and PRs from external contributors

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant