Local deployment not working as the public version

[stavroslyr]

I have downloaded and deployed Bron locally.
It works but not as it should be.
The public version returns matches for CVEs that the local version does not.(not duplicates)
I tried multiple times to redeploy it locally, but it's still the same.
Am i the only one getting this problem?

[hembergerik]

Thank you for your comment.
The discrepancy should be due to the data sources that are used to populate BRON:

• When you deploy BRON locally you download data from the data sources.
• The public version of BRON currently only updates the data sources with intermittent frequency
• The data sources used in BRON are constantly updated with different frequencies, e.g. CVEs are reported more often than ATT&CK tactics

We will check the update frequency of the public BRON instance

[stavroslyr]

If that was the case, the local deployment should have returned more CVEs then.
But it returns less.
Am i missing something?

[hembergerik]

Hmm, let me rebuild my local BRON to see if I can replicate it

[stavroslyr]

Thanks for your help.
I run this query:

LET target = ["CVE-2020-0681", "CVE-2020-0885","CVE-2019-0698", "CVE-2019-0726","CVE-2023-38408","CVE-2020-14145","CVE-2022-20724","CVE-2021-34699","CVE-2008-4963"]

FOR c IN cve
FOR target_element IN target

    Filter c.original_id==target_element
    FOR cw IN CweCve
    FOR cwee in cwe
    FOR each_capec IN CapecCwe
    FOR cp in capec
    FOR tc IN TechniqueCapec
    FOR t in technique
    
    Filter cw._to == c._id
    AND cw._from==cwee._id
    AND each_capec._to==cw._from
    AND each_capec._from==cp._id
    AND tc._to == each_capec._from
    AND tc._from == t._id
    
    COLLECT cveid=c.original_id, 
            cd = c.metadata.description, 
            cweid=cwee.original_id, 
            cwe_n=cwee.name,
            capecid = cp.original_id, 
            capec_n=cp.name, 
            ttpid = t.original_id, 
            ttn = t.name
    SORT cveid DESC
    RETURN {
                    cve_id: cveid,
                    cve_description: cd,
                    cwe_id : cweid,
                    cwe_name : cwe_n,
                    capec_id : capecid,
                    capec_name : capec_n,
                    technique_id: ttpid,
                    technique_name: ttn
            }

[stavroslyr]

I also just saw that the local implementation has 314,886 edges while the public version has 33,382,276.
Also the collection of CWECVE is much much larger (i assume same goes for the rest of the collections)

[hembergerik]

Yes, I see the same now when my local BRON is built. The public BRON might be stale. I am investigating it now.

[hembergerik]

Thank you for your comments!