Framework crosswalks
A crosswalk is a publisher assertion between two framework concepts. Crosswalker writes it as an edge note: the two CURIE identities remain queryable, while managed wikilinks make both endpoint notes visible in the Obsidian graph. The edge is kept even when one endpoint has not been imported. See SSSOM for the interchange format and STRM for the relationship vocabulary.
Status last verified: 2026-09-23 — verified against src/import/stack/stack-run.ts, mapping-readers.ts, src/import/sssom-importer.ts, src/generation/edge-endpoints.ts, and src/import/recipe-registry.ts.
Mapping paths available now
Section titled “Mapping paths available now”| Connection | Source and import path | Relationship handling |
|---|---|---|
| CRI Profile to NIST CSF 2.0 | The CRI workbook’s declared crosswalk column is emitted as edge notes during the CRI framework import. No second mapping file is needed. | The recipe declares its predicate; qualifiers are retained as justification. |
| NIST CSF 2.0 to NIST 800-53 | The stack ships a public-domain NIST-derived SSSOM TSV dated 2026-05-04; a recognized OLIR workbook can be used instead. | OLIR equal, subset of, superset of, and intersects with become SKOS predicates; unknown relationships become related matches. |
| CRI Profile to NIST 800-53 | Optional local CRI OLIR-shaped workbook; never bundled. Its published Focal/Reference direction is reversed when the slot asks for CRI to 800-53, including broad/narrow relation direction. | NIST identifiers are de-padded only on the NIST side. |
| NIST 800-53 to MITRE ATT&CK | Local CTID Mappings Explorer JSON mapping_objects; never bundled. The stack expects ATT&CK release 16.1. | capability_id identifies the NIST subject; attack_object_id identifies the ATT&CK object. mitigates and unspecified types become an overlapping relationship, not an exact match. |
The workbook reader uses formatted Excel text, so numeric-looking identifiers are not silently changed by number parsing. NIST 800-53 IDs use their unpadded canonical form (AC-2, AC-2(1)); CSF and CRI identifiers retain their zeros. Family-level IDs remain valid mapping assertions, but a family without its own imported concept note has no endpoint wikilink.
Import order and reconnection
Section titled “Import order and reconnection”Set up a framework stack imports framework slots first and mapping slots second. Each mapping import creates its own import set and runs through the same SSSOM importer that builds edge notes elsewhere in the plugin. The completion screen counts notes by the discovered import sets and lists unresolved endpoints with an action. Reconnect mappings explicitly refreshes the mapping set IDs recorded during this run; it does not guess a target from a filename or framework label. If a set is gone, reimport that publisher file as a new set. The current run record lives in the open setup modal, not a durable installed-stack registry; persistence is future work.
A missing endpoint is not evidence that the assertion is false. It can mean the corresponding framework was not imported at that detail, or two notes claim the same identity. Crosswalker does not fabricate a concept to fill the link. Import the missing concepts or resolve duplicate identities and then explicitly reconnect the mapping. See framework versioning for why releases need separate provenance, and data sources for acquisition and licence guidance.
Outside the current stack
Section titled “Outside the current stack”ATT&CK to D3FEND and CSF to CIS appear in publisher mapping catalogs but are not stack mapping slots today. The MITRE Fight Fraud Framework (F3) has no published crosswalk at all yet: it shares technique and tactic ids with ATT&CK directly instead of mapping to it, and whether a shared id should resolve to the same concept is an open question. The old frameworks_to_obsidian.py tool and its exact-match/regex table are retired; neither describes the plugin’s current mapping behavior. The in-repository headless OLIR and melt converters remain available separately for local corpus work; stack users do not need to run them.