Add exercise inject
Add one inject to the MSEL – a copy when it comes from the library, its techniques moved onto the MSEL’s ATT&CK release. Answers the whole MSEL, as its other writes do, and what the move changed.
Authorizations
Section titled “Authorizations”Request Bodyrequired
Section titled “Request Bodyrequired”POST /ttx/{ttx_id}/msel/injects: one inject added to the MSEL – a copy of a library inject, already in the exercise’s language with its variables filled in. The MSEL’s own save rules apply afterwards (the validation report judges it; nothing here needs to be complete).
object
Whose activity an inject’s ATT&CK techniques are: a threat actor of the scenario’s, or noise – unrelated activity (other attackers, commodity malware, coincidences, false positives) that tests the players’ triage. None (the column null): no ATT&CK at all.
An ATT&CK technique under the tactic it serves, by id. Whether it exists is checked against the MSEL’s pinned release by the service (the payload doesn’t carry the release).
object
What an inject is, and so what it asks of the table: an inject that evaluates objectives (INJ), a discussion slide – a debrief or reflection prompt, no objective, not in the EEG nor the coverage (DSC) –, or a poll the Players vote on, outside the evaluation too (POL).
Where a simulated actor comes from – the actor library’s levels. An exercise’s cast only holds copies; the origin says of what.
Who sends it, when it isn’t already in the cast: found there by its TTX-Zone id or its name, or added as a copy.
object
Where a simulated actor comes from – the actor library’s levels. An exercise’s cast only holds copies; the origin says of what.
Responses
Section titled “Responses”Successful Response
POST /ttx/{ttx_id}/msel/injects: the MSEL, and what moving the copy’s techniques onto its ATT&CK release changed.
object
What moving references onto another ATT&CK release changed: MITRE’s replacements applied (techniques and groups) and what that release doesn’t have.
object
object
object
object
Where a simulated actor comes from – the actor library’s levels. An exercise’s cast only holds copies; the origin says of what.
With its names in the pinned release (English, as MITRE publishes them) – kept in snapshots, so a frozen MSEL reads on its own.
object
A version of the MSEL frozen when it became READY, and the sessions played from it.
object
object
An inject’s content rendered as a simulated artifact. The body is the
inject’s own content; these are the template’s other fields, whose
meaning follows kind (email: from, address, to, subject, date; press
release: outlet, dateline, headline, date; social post: author, handle,
date; chat message: sender, channel, date). All plain text: the
Playground draws them, nothing is ever rendered as markup.
object
How the Playground renders an inject’s content as a simulated artifact (a template drawn by the app, never uploaded markup).
Whose activity an inject’s ATT&CK techniques are: a threat actor of the scenario’s, or noise – unrelated activity (other attackers, commodity malware, coincidences, false positives) that tests the players’ triage. None (the column null): no ATT&CK at all.
With its names in the pinned release (English, as MITRE publishes them) – kept in snapshots, so a frozen MSEL reads on its own.
object
object
object
What an inject is, and so what it asks of the table: an inject that evaluates objectives (INJ), a discussion slide – a debrief or reflection prompt, no objective, not in the EEG nor the coverage (DSC) –, or a poll the Players vote on, outside the evaluation too (POL).
object
Where a simulated actor comes from – the actor library’s levels. An exercise’s cast only holds copies; the origin says of what.
object
object
What the MSEL needs from the needs analysis to be edited: the objectives to link, the participants recipients must be (M09: the participating areas and, optional, the third parties), the duration limit and the TLP it inherits. Nothing else of the form.
object
object
Capabilities an exercise can validate – TTX-Zone’s own taxonomy.
FIRST Traffic Light Protocol 2.0 labels.
object
A room of the exercise, as the MSEL aims injects at it.
object
object
Where a simulated actor comes from – the actor library’s levels. An exercise’s cast only holds copies; the origin says of what.
object
ready blocks DRAFT -> READY_FOR_APPROVAL, approved additionally
blocks READY_FOR_APPROVAL -> APPROVED; warnings never block.
object
One rule a form breaks. section is the form section (0-9) to send
the user to; field the field within it; item_id the row (need,
objective) or value (capability, approver kind) concerned, if any.
One rule a form breaks. section is the form section (0-9) to send
the user to; field the field within it; item_id the row (need,
objective) or value (capability, approver kind) concerned, if any.
One rule a form breaks. section is the form section (0-9) to send
the user to; field the field within it; item_id the row (need,
objective) or value (capability, approver kind) concerned, if any.
Example
{ "msel": { "actors": [ { "channel": "email", "description": "", "origin": "system", "type": "soc" } ], "attack_techniques": [ { "domain": "enterprise" } ], "injects": [ { "artifact": { "kind": "email", "location": "", "recipient": "", "sender": "", "sender_address": "", "subject": "", "timestamp": "" }, "attack_attribution": "threat_actor", "attack_techniques": [ { "domain": "enterprise" } ], "delivery_method": "email", "files": [], "format": "inject", "images": [], "kind": "mandatory", "origin": "system", "poll_impacts": [], "poll_options": [], "poll_outcomes": [], "poll_question": "", "review_status": "draft", "room_ids": [] } ], "needs": { "objectives": [ { "capability": "detection_triage_escalation", "title": "" } ], "status": "draft", "third_parties": [], "tlp": "clear" }, "phases": [ { "due_objective_ids": [], "headline": "", "incident_jump_minutes": 0 } ], "ready_by": "", "status": "draft", "threat_actors": [ { "origin": "system", "techniques": [ { "domain": "enterprise" } ] } ], "uses_rooms": false }}Validation Error
object
object
object
Example generated
{ "detail": [ { "ctx": {}, "input": "example", "loc": [ "example" ], "msg": "example", "type": "example" } ]}