MAINT: Add DEFAULT strategy alias to airt.cyber scenario#2061
Open
varunj-msft wants to merge 1 commit into
Open
MAINT: Add DEFAULT strategy alias to airt.cyber scenario#2061varunj-msft wants to merge 1 commit into
varunj-msft wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Part of the Standardizing Scenarios effort. This brings
airt.cyberin line withthe convention the other scenarios follow: a
DEFAULTstrategy aggregate that drives thedefault run, with
ALLkept for the exhaustive run.Cyber only has one technique today (
red_teaming), soDEFAULTexpands to exactly the samething as
ALL— this isn't a behavior change, it's added for cross-scenario convention parityso
--strategies defaultworks uniformly everywhere.One wrinkle worth calling out:
red_teamingisn't taggeddefaultin the shared techniquecatalog, so the usual
TagQuery.any_of("default")would produce an empty aggregate and collapsethe default run to baseline-only. Cyber's
DEFAULTmatchescoreinstead, which selects thecurated technique without tagging
red_teamingglobally (that would leak it into otherscenarios' default runs). There's a comment on
_CYBER_TECHNIQUE_NAMESnoting that addinganother
core-tagged technique would pull it into DEFAULT.Not a breaking change: the default run produces the same atomic attacks as before (same
red_teaming+ baseline), so output is byte-identical and--resumestays compatible. NoVERSION bump needed.
Tests and Documentation
Tests (tests/unit/scenario/airt/test_cyber.py):
All 25 cyber tests pass; full airt scenario suite (164) green. ruff, ruff format, and ty clean.
Documentation (doc/scanner/airt.py + .ipynb):