rabobank-cdc/dettect

How rabobank-cdc/dettect works

DeTT&CT supports blue teams mapping ATT&CK data sources, visibility, detections, and threat-actor behavior. Users administer scores and mappings in YAML through the Editor or CLI; the CLI analyzes those files and produces Navigator layers, reports, and exports. The graph preserves the documented scoring and comparison capabilities, while source excerpts chiefly establish CLI orchestration and selected Editor interactions; some capability links are therefore documented rather than implementation-traced.

Main entry points: dettect.py CLI commands · generic.py Shared ATT&CK utilities · group_mapping.py Group behavior mapping · data_source_mapping.py Data source mapping

Components 19

YAML Editor

Editor application editor/src/main.js
YAML editing pages editor/src/pages
Page editing helpers editor/src/mixins/PageMixins.js
Editor notifications editor/src/mixins/NotificationMixins.js

CLI workflows

CLI commands dettect.py
Generic workflows generic_mode.py
YAML upgrade upgrade.py

ATT&CK data

ATT&CK TAXII client attack_taxii_client.py
Shared ATT&CK utilities generic.py

Mapping and scoring

Data source mapping data_source_mapping.py
Technique mapping technique_mapping.py
Group behavior mapping group_mapping.py
Technique search eql_yaml.py
Coverage comparison health.py

Visualizations and exports

Navigator layer generation navigator_layer.py
File and export output file_output.py

Other components

Blue team user
ATT&CK STIX data
ATT&CK Navigator

Connections 29

Blue team user → Editor application: edits YAML
Editor application → YAML editing pages: routes to
YAML editing pages → Page editing helpers: uses editor/src/pages/DataSourcesPage.vue
YAML editing pages → Editor notifications: notifies through editor/src/pages/TechniquesPage.vue
Blue team user → CLI commands: runs commands
CLI commands → Data source mapping: dispatches dettect.py
CLI commands → Technique mapping: dispatches dettect.py
CLI commands → Group behavior mapping: dispatches dettect.py
CLI commands → Technique search: dispatches dettect.py
CLI commands → Generic workflows: dispatches dettect.py
CLI commands → YAML upgrade: dispatches dettect.py
Generic workflows → Shared ATT&CK utilities: uses generic_mode.py
Shared ATT&CK utilities → ATT&CK TAXII client: loads ATT&CK data generic.py
ATT&CK STIX data → ATT&CK TAXII client: provides STIX data
Data source mapping → Shared ATT&CK utilities: uses data_source_mapping.py
Data source mapping → Navigator layer generation: builds layers data_source_mapping.py
Data source mapping → File and export output: exports files data_source_mapping.py
Technique mapping → Shared ATT&CK utilities: uses technique_mapping.py
Technique mapping → Navigator layer generation: builds layers technique_mapping.py
Technique mapping → File and export output: exports files technique_mapping.py
Group behavior mapping → Technique search: searches techniques group_mapping.py
Group behavior mapping → Shared ATT&CK utilities: uses group_mapping.py
Group behavior mapping → Navigator layer generation: builds overlays group_mapping.py
Group behavior mapping → File and export output: writes output group_mapping.py
Technique search → Shared ATT&CK utilities: uses eql_yaml.py
Coverage comparison → Shared ATT&CK utilities: uses generic.py
YAML upgrade → Shared ATT&CK utilities: uses upgrade.py
YAML upgrade → File and export output: writes backups upgrade.py
Navigator layer generation → ATT&CK Navigator: layers for

More SCSS diagrams: keyvanakbary/learning-notes · mqtt/mqtt.org · twitter/opensource-website · khang-nd/7.css · bedimcode/portfolio-responsive-complete

Drawn by GitDiagram on September 30, 2026 from the repository's file tree, README and source files. Read as Markdown ·