Create JSON/YAML index of SAFE-MCP techniques

[bochristopher]

Currently, techniques are only listed in Markdown under each tactic. This makes it difficult for developers and security teams to programmatically consume SAFE-MCP content.

Proposal:

• Add a machine-readable index (techniques.json or techniques.yaml) with fields:

{
  "id": "SAFE-T1102",
  "name": "Prompt Injection",
  "tactic": "Execution",
  "description": "...",
  "mitre_mappings": ["T1565.001"],
  "mitigations": ["X", "Y"],
  "detections": ["example"]
}

• Store under /data/ or /schemas/ directory.

• Add a GitHub Action to validate that new techniques added in Markdown are also updated in the JSON/YAML.

Why:
• Enables external tooling, dashboards, and automation to ingest SAFE-MCP techniques directly.
• Makes it easier to cross-link tactics ↔ techniques ↔ mitigations in docs or a future website.

Next step:
I can draft the schema and initial converter script to populate the JSON index from existing Markdown techniques.

[bishnubista]

@bochristopher Hi bo, the project already has partial structured data in two formats:

• Standalone detection-rule.yml files in technique folders
• Sigma rules embedded in README.md files (like in technique-safe-t1007)

@fkautz Should we consolidate the Sigma rules currently in README.md files into the detection-rule.yml files first, or include both formats in the central index?

[fkautz]

This is a fantastic idea, and is something that's been sitting on my mind.

MITRE ATLAS has a data repository for this purpose. I think having a data/ directory in here would be a great way to do this. I'd love to see a PR in this direction if you are willing to give it a shot.

I am also wondering if we can do something similar to compliance trestle that converts markdown to the structured format, and back.

https://github.com/mitre-atlas/atlas-data/blob/main/data/techniques.yaml
https://github.com/oscal-compass/compliance-trestle

@bochristopher let me know what you decide to do!

[bochristopher]

Thanks for the valuable inputs! Here’s how I'll move forward:

• Create a JSON/YAML schema for techniques under a data/ directory
• Consolidate existing structured data into this schema, including both detection-rule.yml and embedded Sigma rules, open to feedback on whether to eventually migrate Sigma rules fully into one format
• Set up GitHub Actions for validation
• Add two-way conversion between Markdown and structured formats (similar to Compliance Trestle) so both stay in sync

I’ll share the PR link here once it’s ready and would love your feedback as it takes shape!

[bochristopher]

Opened PR #68 to start on the schema and validation work. Feedback welcome!