Infer the value of x_mitre_domains on exported groups

[isaisabel]

As a client of the ATT&CK Workbench REST API, I would like the x_mitre_domains field on groups (intrusion-sets) to be automatically populated when those objects are retrieved from the export endpoints (GET /api/collection-bundles and GET /api/stix-bundles). x_mitre_domains is used by tools like ATT&CK Navigator to determine the relevant domain of the group when loading data.

• The domains of a group should be inferred from its relationships to objects in the knowledge base -- groups which map to enterprise techniques or software are implicitly part of the enterprise domain themselves. Users of the workbench frontend won't be maintaining the x_mitre_domains field of groups directly so they must be instead computed on export.
• On the /api/stix-bundles/?domain=X, groups are behaviorally similar to secondary objects (objects included because they have mappings to objects within the domain), however groups inferred to be within the domain may themselves have secondary objects. For instance, a technique within the domain may cause the inclusion of a mapped group as a secondary object, which itself may cause the inclusion of a software mapped to the group.
• Groups imported into the knowledge base will likely include x_mitre_domains values, but the Workbench should not assume that these values are up-to-date with custom mappings. It may be preferable to drop the x_mitre_domains field from intrusion-sets within the knowledge base to avoid accidental misuse of that field.

[dickens88]

Hi @isaisabel @clemiller ,

Is there any workaround to this issue? Currently, if I'm using Navigator v4.5.5 and syncing data from Workbench, it doesn't seem to be able to show my custom red teams (groups) to Navigator. That is very inconvenient : (