# Decider | A Web Application That Assists Network Defenders, Analysts, And Researcher **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, programming, freebies\ **Created:** [March 29, 2023, 2:19pm UTC](https://onehack.st/t/decider-a-web-application-that-assists-network-defenders-analysts-and-researcher/235288 "2023-03-29T14:19:06Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\ **Post date:** [March 29, 2023, 2:19pm UTC](https://onehack.st/t/decider-a-web-application-that-assists-network-defenders-analysts-and-researcher/235288/1 "2023-03-29T14:19:06Z")
[https://github.com/cisagov/decider/raw/develop/docs/imgs/docker-started-1.0.0.png](https://github.com/cisagov/decider/raw/develop/docs/imgs/docker-started-1.0.0.png) # Decider ## Notifications - Manual installation for Ubuntu & CentOS is much nicer. - Scroll down to **Manual Install** for details! - Will be adding information about hardware requirements soon ## What is it? ### The Short A web application that assists network defenders, analysts, and researchers in the process of mapping adversary behaviors to the MITRE ATT&CK® framework. ### The Long Decider is a tool to help analysts map adversary behavior to the MITRE ATT&CK framework. Decider makes creating ATT&CK mappings easier to get right by walking users through the mapping process. It does so by asking a series of guided questions about adversary activity to help them arrive at the correct tactic, technique, or subtechnique. Decider has a powerful search and filter functionality that enables users to focus on the parts of ATT&CK that are relevant to their analysis. Decider also has a cart functionality that lets users export results to commonly used formats, such as tables and ATT&CK Navigator™ heatmaps. ### The Screenshots #### Decider’s Question Tree (_you are here_)**[Matrix \> Tactic]** \> Technique \> SubTechnique [![Decider's Question Tree Page](https://github.com/cisagov/decider/raw/develop/docs/imgs/question-tree-1.0.0.png)](https://github.com/cisagov/decider/blob/develop/docs/imgs/question-tree-1.0.0.png) #### Decider’s Full Technique Search Boolean expressions, prefix-matching, and stemming included. [![Decider's Full Technique Search Page](https://github.com/cisagov/decider/raw/develop/docs/imgs/full-search-1.0.0.png)](https://github.com/cisagov/decider/blob/develop/docs/imgs/full-search-1.0.0.png) ### The Notice This project makes use of MITRE ATT&CK - [ATT&CK Terms of Use](https://attack.mitre.org/resources/terms-of-use/) ## Usage **Read the [User Guide](https://github.com/cisagov/decider/blob/develop/docs/Decider_User_Guide_v1.0.0.pdf)** ## Installation ### Docker **Best option for 99% of people** git clone [https://github.com/cisagov/decider.git](https://github.com/cisagov/decider.git) cd decider cp .env.docker .env # if you want HTTPS instead of HTTP # - edit .env # + WEB\_HTTPS\_ON=‘yes’ # - populate cert / key files # + /app/utils/certs/decider.key # + /app/utils/certs/decider.crt [sudo] docker compose up # sudo for Linux only It is ready when **Starting uWSGI** appears [![Decider on Docker Boot Terminal Output](https://github.com/cisagov/decider/raw/develop/docs/imgs/docker-started-1.0.0.png)](https://github.com/cisagov/decider/blob/develop/docs/imgs/docker-started-1.0.0.png) **Default Endpoint** : [http://localhost:8001/](http://localhost:8001/) **Default Login** : - Email: [admin@admin.com](mailto:admin@admin.com) - Password: admin **Endpoint Determination** (.env vars): - `WEB_HTTPS_ON=''` → http://`WEB_IP`:`WEB_PORT`/ - `WEB_HTTPS_ON='anything'` → https://`WEB_IP`:`WEB_PORT`/ **HTTPS Cert Location** : - Write these 2 files before `docker compose up` to set your SSL cert up - /app/utils/certs/decider.key - /app/utils/certs/decider.crt - If either file is missing, a self-signed cert is generated and used instead **DB Persistence Note** : Postgres stores its data in a Docker volume to persist the database. #### Linux tested on: - Ubuntu Jammy 22.04.2 LTS - Docker Engine - Not Docker Desktop (couldn’t get nested-virt in my VM) #### Windows tested on: - Windows 11 Home, version 22H2, build 22621.1344 - Home doesn’t support HyperV - Thus tested on Docker Desktop [via WSL backend](https://docs.docker.com/desktop/windows/wsl/) #### macOS (M1) tested on: - macOS Ventura 13.2.1 (22D68) - Mac M1 Processor - On Docker Desktop installed via .dmg ### Manual Install #### Ubuntu 22.04 [Ubuntu Install Guide](https://github.com/cisagov/decider/blob/develop/docs/install/Ubuntu_22.04.2.md) #### CentOS 7 [CentOS Install Guide](https://github.com/cisagov/decider/blob/develop/docs/install/CentOS_7.md) #### Other OSes Read the Ubuntu & CentOS guides and recreate actions according to your platform. ##### Windows `open()` in Python uses the system’s default text encoding - This is `utf-8` on macOS and Linux - This is `windows-1252` on Windows - This causes issues in reading the jsons for the database build process - Adding `encoding='utf-8'` as an arg in each `open()` _ **may** _ allow Windows deployment ##### macOS (M1 users at least) Make sure to (1) install Postgres before (2) installing the pip requirements 1. `brew install postgresql` 2. `pip install -r requirements.txt` ## GitHub: [https://github.com/cisagov/decider](https://github.com/cisagov/decider)