From 995bcd7170dc3179c91cfa9ee5d29a3b2e9c6c1f Mon Sep 17 00:00:00 2001 From: Nick Todd Date: Mon, 3 Mar 2025 14:53:05 +0000 Subject: [PATCH 1/4] #3105: Updated and corrected entries. --- CHANGELOG.md | 19 ++++--------------- 1 file changed, 4 insertions(+), 15 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6f1c2324..1e81771b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,13 +5,13 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). -## [4.0.0] = TBC +## [4.0.0] = 2025-03-XX ### Added -- Log observation space data by episode and step. - Added `show_history` method to Agents, allowing you to view actions taken by an agent per step. By default, `do-nothing` actions are omitted. - New ``node-send-local-command`` action implemented which grants agents the ability to execute commands locally. (Previously limited to remote only) - Added ability to set the observation threshold for NMNE, file access and application executions +- UC7 Scenario model changes plus config files and example notebooks. ### Changed - Agents now follow a common configuration format, simplifying the configuration of agents and their extensibilty. @@ -29,26 +29,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Nodes now use a config schema and are extensible, allowing for plugin support. - Node tests have been updated to use the new node config schemas when not using YAML files. - Documentation has been updated to include details of extensability with PrimAITE. -- ACLs are no longer applied to layer-2 traffic. -- Random number seed values are recorded in simulation/seed.log if the seed is set in the config file - or `generate_seed_value` is set to `true`. -- ARP .show() method will now include the port number associated with each entry. -- Added `services_requires_scan` and `applications_requires_scan` to agent observation space config to allow the agents to be able to see actual health states of services and applications without requiring scans (Default `True`, set to `False` to allow agents to see actual health state without scanning). -- Updated the `Terminal` class to provide response information when sending remote command execution. - ### Fixed - DNS client no longer fails to check its cache if a DNS server address is missing. - DNS client now correctly inherits the node's DNS address configuration setting. -## [3.3.0] - 2024-09-04 - -## [3.4.0] +## [3.3.1] - 2024-12-04 ### Added - Log observation space data by episode and step. -- Added `show_history` method to Agents, allowing you to view actions taken by an agent per step. By default, `DONOTHING` actions are omitted. -- New ``NODE_SEND_LOCAL_COMMAND`` action implemented which grants agents the ability to execute commands locally. (Previously limited to remote only) - Added ability to set the observation threshold for NMNE, file access and application executions ### Changed @@ -56,7 +45,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Random number seed values are recorded in simulation/seed.log if the seed is set in the config file or `generate_seed_value` is set to `true`. - ARP .show() method will now include the port number associated with each entry. -- Added `services_requires_scan` and `applications_requires_scan` to agent observation space config to allow the agents to be able to see actual health states of services and applications without requiring scans (Default `True`, set to `False` to allow agents to see actual health state without scanning). +- Added `services_requires_scan` and `applications_requires_scan` to agent observation space config to allow the agents to be able to see actual health states of services and applications without requiring scans (default `True`, set to `False` to allow agents to see actual health state without scanning). - Updated the `Terminal` class to provide response information when sending remote command execution. ## [3.3.0] - 2024-09-04 From d9191abd0f330e994e39ab1114d1a2c82a4c5d9f Mon Sep 17 00:00:00 2001 From: Nick Todd Date: Mon, 3 Mar 2025 15:26:19 +0000 Subject: [PATCH 2/4] #3105: Pre-commit changes. --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1e81771b..331177fd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,7 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Added `show_history` method to Agents, allowing you to view actions taken by an agent per step. By default, `do-nothing` actions are omitted. - New ``node-send-local-command`` action implemented which grants agents the ability to execute commands locally. (Previously limited to remote only) - Added ability to set the observation threshold for NMNE, file access and application executions -- UC7 Scenario model changes plus config files and example notebooks. +- UC7 Scenario model changes plus config files and example notebooks. ### Changed - Agents now follow a common configuration format, simplifying the configuration of agents and their extensibilty. From 7775403067666b368d8d9f395e6087d7121f7f2f Mon Sep 17 00:00:00 2001 From: Nick Todd Date: Tue, 4 Mar 2025 12:26:25 +0000 Subject: [PATCH 3/4] #3105: Code review changes. --- CHANGELOG.md | 42 ++++++++++++++++++++++++------------------ 1 file changed, 24 insertions(+), 18 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 331177fd..b285ef0f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,12 +8,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [4.0.0] = 2025-03-XX ### Added +- Log observation space data by episode and step. +- Added ability to set the observation threshold for NMNE, file access and application executions. - Added `show_history` method to Agents, allowing you to view actions taken by an agent per step. By default, `do-nothing` actions are omitted. -- New ``node-send-local-command`` action implemented which grants agents the ability to execute commands locally. (Previously limited to remote only) -- Added ability to set the observation threshold for NMNE, file access and application executions -- UC7 Scenario model changes plus config files and example notebooks. +- New ``node-send-local-command`` action implemented which grants agents the ability to execute commands locally. (Previously limited to remote only) +- Added ability to set the observation threshold for NMNE, file access and application executions +- UC7 Scenario model changes including Threat Actor Profile, TAP001 and TAP003 agents plus config files and example notebooks. +- New HOW-TO guides describing how to use the new extension system to customise actions, environments and rewards. +- Added version and plugin fields to YAML configs to ensure compatibility with future versions. +- Network Node Adder class provides a framework for adding nodes to a network in a standardised way. ### Changed +- ACL's are no longer applied to layer-2 traffic. +- Random number seed values are recorded in simulation/seed.log if the seed is set in the config file + or `generate_seed_value` is set to `true`. +- ARP .show() method will now include the port number associated with each entry. +- Added `services_requires_scan` and `applications_requires_scan` to agent observation space config + to allow the agents to be able to see actual health states of services and applications without + requiring scans (default `True`, set to `False` to allow agents to see actual health state without scanning). +- Updated the `Terminal` class to provide response information when sending remote command execution. - Agents now follow a common configuration format, simplifying the configuration of agents and their extensibilty. - Actions within PrimAITE are now extensible, allowing for plugin support. - Added a config schema to `ObservationManager`, `ActionManager`, and `RewardFunction`. @@ -23,31 +36,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Action parameters are no longer defined through IDs, instead meaningful data is provided directly in the action map - Test and example YAMLs have been updated to match the new agent and action schemas, such as: - Removed empty action spaces, observation spaces, or reward spaces for agent which didn't use them - - Relabeled action parameters to match the new action config schemas, and updated the values to no longer rely on indices + - Relabelled action parameters to match the new action config schemas, and updated the values to no longer rely on indices - Removed action space options which were previously used for assigning meaning to action space IDs - Updated tests that don't use YAMLs to still use the new action and agent schemas - Nodes now use a config schema and are extensible, allowing for plugin support. - Node tests have been updated to use the new node config schemas when not using YAML files. - Documentation has been updated to include details of extensability with PrimAITE. +- Software is created in the GOOD health state instead of UNUSED. +- Standardised naming convention for YAML config files using kebab-case. + This naming convention is used for configuring software, observations, actions and node types. + NB: A migration guide will be available with this release. + ### Fixed - DNS client no longer fails to check its cache if a DNS server address is missing. - DNS client now correctly inherits the node's DNS address configuration setting. +- ACL observations now include the ACL at index 0. +- SoftwareManager.show() correctly displays all the software associated with a port whether the software is listening or not. -## [3.3.1] - 2024-12-04 - -### Added -- Log observation space data by episode and step. -- Added ability to set the observation threshold for NMNE, file access and application executions - -### Changed -- ACL's are no longer applied to layer-2 traffic. -- Random number seed values are recorded in simulation/seed.log if the seed is set in the config file - or `generate_seed_value` is set to `true`. -- ARP .show() method will now include the port number associated with each entry. -- Added `services_requires_scan` and `applications_requires_scan` to agent observation space config to allow the agents to be able to see actual health states of services and applications without requiring scans (default `True`, set to `False` to allow agents to see actual health state without scanning). -- Updated the `Terminal` class to provide response information when sending remote command execution. - ## [3.3.0] - 2024-09-04 ### Added - Random Number Generator Seeding by specifying a random number seed in the config file. From 65dee930b191031e39950b6925eedbdfd9f3b722 Mon Sep 17 00:00:00 2001 From: Nick Todd Date: Wed, 5 Mar 2025 11:35:46 +0000 Subject: [PATCH 4/4] #3105: Further PR comments. --- CHANGELOG.md | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b285ef0f..fbcfa707 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,18 +14,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - New ``node-send-local-command`` action implemented which grants agents the ability to execute commands locally. (Previously limited to remote only) - Added ability to set the observation threshold for NMNE, file access and application executions - UC7 Scenario model changes including Threat Actor Profile, TAP001 and TAP003 agents plus config files and example notebooks. -- New HOW-TO guides describing how to use the new extension system to customise actions, environments and rewards. +- New how-to guides describing how to use the new extension system to customise actions, environments and rewards. - Added version and plugin fields to YAML configs to ensure compatibility with future versions. - Network Node Adder class provides a framework for adding nodes to a network in a standardised way. ### Changed -- ACL's are no longer applied to layer-2 traffic. +- ACLs are no longer applied to layer-2 traffic. - Random number seed values are recorded in simulation/seed.log if the seed is set in the config file or `generate_seed_value` is set to `true`. - ARP .show() method will now include the port number associated with each entry. -- Added `services_requires_scan` and `applications_requires_scan` to agent observation space config - to allow the agents to be able to see actual health states of services and applications without - requiring scans (default `True`, set to `False` to allow agents to see actual health state without scanning). +- The behaviour that services, applications, files and folders require scanning before their observations are updated is now optional. - Updated the `Terminal` class to provide response information when sending remote command execution. - Agents now follow a common configuration format, simplifying the configuration of agents and their extensibilty. - Actions within PrimAITE are now extensible, allowing for plugin support.