mitre_mapper.py

from __future__ import annotations

from typing import Any, Optional


def keyword_to_technique(keyword: str) -> dict[str, Optional[str]]:
    k = keyword.strip().lower()

    mapping: dict[str, dict[str, Optional[str]]] = {
        "nmap": {"technique_id": "T1046", "tactic": "Reconnaissance"},
        "curl": {"technique_id": "T1105", "tactic": "Command and Control"},
        "wget": {"technique_id": "T1105", "tactic": "Command and Control"},
        "cat": {"technique_id": "T1005", "tactic": "Collection"},
        "grep": {"technique_id": "T1082", "tactic": "Discovery"},
        "chmod": {"technique_id": "T1222.001", "tactic": "Defense Evasion"},
        "sudo": {"technique_id": "T1068", "tactic": "Privilege Escalation"},
    }

    return mapping.get(k, {"technique_id": None, "tactic": None})


def map_keywords_to_techniques(keywords: list[str]) -> dict[str, Any]:
    matches = []
    technique_ids: list[str] = []

    for kw in keywords:
        info = keyword_to_technique(kw)
        technique_id = info.get("technique_id")
        if technique_id and technique_id not in technique_ids:
            technique_ids.append(technique_id)
        matches.append({"keyword": kw, **info})

    return {"technique_ids": technique_ids, "matches": matches}