be4ce55239
Merge pull request #57 from OTRF/developer
...
General repo update
2022-09-24 19:06:05 -04:00
f946a6f52e
Updated and Run ossemDM.py
...
- Updated Sysmon log_source reference to Microsoft-Windows-Sysmon. Enable commands commands are now populated for Windows Sysmon events.
2022-09-22 19:09:15 -04:00
a5a8d235f8
Update README.md
...
Updated README description
2022-09-22 18:54:28 -04:00
96c7f727c7
Update ossemDM.py
...
- added channel field to output files
2022-09-22 13:48:17 -04:00
b24952b4e0
Updated ossemDM.py script
...
- added field channel to yml, json, and csv files
- updated all_ossem_relationships and attack files
2022-09-22 13:47:45 -04:00
ed1cbddce4
General update on relationships
...
- updated numerical event_id to string.
- alignment with OSSEM-DD and readme description
2022-09-22 13:07:27 -04:00
ede280ad4d
Updated EventLog relationships
...
- added channel field and updated log_source field
- did not run python script. Will do after adding channel field for all events
2022-09-22 12:22:19 -04:00
9ec27e0e41
Updated Windows Service Control Manager relationships
...
- added channel field and updated log_source field
- also added event version
2022-09-22 12:01:45 -04:00
3a47d0c216
Updated Windows Firewall With Advanced Security relationships
...
- added channel and updated log_source fields
- did not run python script. Will do after adding channel field for all events
2022-09-22 11:44:30 -04:00
c67bcceefc
Updated PowerShell Event
...
- Updated channel and log_source fields
- added .DS_Store to gitignore
2022-09-22 10:20:13 -04:00
c9dccda43e
Updated Windows Security Auditing Relationships
...
- Added Channel field
- Added references (URL) for Security auditing and sysmon events
- did not run python script. Will do after adding channel field for all events
2022-09-21 23:40:42 -04:00
cf5bd31ca3
Updated Windows Sysmon Relationships
...
- Updated log_source to Microsoft-Windows-SysmonMicrosoft-Windows-Sysmon
- added channel: Microsoft-Windows-Sysmon/Operational
- Did not run python script. Will do after adding channel field
2022-09-20 10:15:35 -04:00
7e2d86a6ec
Update README.md
...
added missing description in Notes
2022-09-20 09:16:25 -04:00
7e96dacdbf
Updated of README file
...
Added Documentation Format and Schema section.
We are adding the `Channel` field to the schema. I need to add this field to yaml files.
2022-09-20 09:14:02 -04:00
0576cd1f92
Merge pull request #56 from OTRF/developer
...
Merge pull request #53 from OTRF/main
2022-09-20 00:59:54 -04:00
96ce340021
Merge pull request #54 from Kyrasuum/main
...
fixing missing characters in yml
2022-08-18 21:51:52 -04:00
40c06b01bb
Added missing space
2022-08-10 13:53:16 -04:00
2394565bb8
fixing missing '-'
2022-08-10 13:29:02 -04:00
e503bc29f0
Merge pull request #53 from OTRF/main
...
Merge pull request #52 from OTRF/developer
2022-08-05 09:57:00 -04:00
0e3d40d8ad
Merge pull request #52 from OTRF/developer
...
Initial revamp of the OSSEM Project - Data Modeling component
2022-08-05 09:56:08 -04:00
c7f3a2ad9d
Aligning source and target entities with OSSEM-CDM
...
- host --> device
- windows registry key --> registry
- windows registry key value --> registry
- logon session --> logon
- Merged Windows Registry Key and Windows Registry Key Value under Registry
- Still need to update techniques to event mapping files (Use Cases): TAXII server not working when making this commit.
2022-08-05 09:42:40 -04:00
e2c9f58d10
attack data source name to lower case in all relationships
...
Also updated all aggregated files
2022-06-28 12:06:08 -04:00
3759ceaff9
Updated schema and attack mapping for Windows Firewall With Advanced Security events
...
- log_source: Microsoft-Windows-Windows Firewall With Advanced Security
- issue created in OSSEM-DD: Creation of dictionaries required - https://github.com/OTRF/OSSEM-DD/issues/39
2022-06-28 08:51:31 -04:00
a1ee4c7615
Updated schema for Powershell events
2022-06-28 07:54:05 -04:00
8f53d4dbdd
Update Schema to align with DD & Update of ossemDM script
...
Update of Schema to align with OSSEM-DD:
- log_source field instead of log_provider and log_channel
- platform field: Windows to windows, Linux to linux, Sysmon to sysmon
Update of ossemDM.py:
- added filter_in to attack_events_mapping.csv
- update based on new schema (lower case of platform field)
2022-06-27 23:05:28 -04:00
0251be6fc9
Merge branch 'pr/43' into developer
2022-06-27 18:40:01 -04:00
8b7229f133
Merge branch 'main' into developer
2022-06-26 12:31:11 -04:00
f63734851c
Update of Schema for Microsoft Defender for Endpoint event logs
...
Removed audit category, log_channel
Changed log_provider for log_source (Match OSSEM-DD)
Using filter_in section to describe the ActionType field
Added event version 1
2022-06-24 11:51:22 -04:00
e25862cb22
Merge pull request #50 from Kyrasuum/main
...
Fixed some typos
2022-05-14 14:45:29 -07:00
b665947ace
Delete techniques_to_events_mapping.yaml
...
Generating it locally with recent changes
2022-05-14 14:44:59 -07:00
18dda0771e
Updated AWS, Sysmon and Security relationships: log_provider & log_source
...
AWS & Sysmon: Deleted log_provider
Security: log_source: Microsoft-Windows-Security-Auditing
2022-05-03 13:41:43 -04:00
ed5982b0f2
Updated All Sysmon Relations (Provider/Source)
...
log_provider: Microsoft-Windows-Sysmon/Operational
log_source: Sysmon
log_provider: Linux-Sysmon/Operational
log_source: Sysmon
2022-05-03 10:51:49 -04:00
f7801a3429
Updated AWS security events in relationships
...
Using filter_in for eventType and eventName.
Using log_source and log_provider concepts
2022-05-02 18:32:48 -04:00
c0c9cf47e2
Adding Event_Version field to security events Part 2 of 2
2022-04-29 23:22:23 -04:00
3af9307bed
Adding Event_Version field to security events Part 1 of 2
2022-04-28 13:01:16 -04:00
555ae4532c
Fixed some typos which made processing by golang json/yaml loaders impossible
2022-03-16 16:12:15 -04:00
e3477a1c18
ossemDM.py adds relationship ids
...
There is no need to add relationship id at the beginning of a yaml file when creating a PR.
The script will add the id based on current year and current relationships ids
2022-03-14 18:09:16 -04:00
4a62e7c170
Updated ossemDM.py to generate json file with all OSSEM relationships
2022-03-12 15:50:18 -05:00
b47d0c8eae
Merge pull request #46 from H1L021/main
...
Adding Logon Process Trusted
2022-03-12 15:35:14 -05:00
0ad533ea17
Merge pull request #45 from olafhartong/main
...
rebrand MDE and add proper channel and event data
2022-03-12 14:59:50 -05:00
fa839a6a18
Create generate_uuid.py
...
adding_uuid.py will append a new ID to every Yaml file. generate_uuid will go through existing ID and an generated a new one for future contributions.
2022-03-11 18:23:04 +01:00
5ba00a4367
Create logon_process_trusted.yml
...
This event indicates that a logon process has registered with the Local Security Authority (LSA). At the technical level, the event does not come from the registration of a trusted logon process, but from a confirmation that the process is a trusted logon process. If it is a trusted logon process, the event generates.
2022-03-11 18:20:57 +01:00
a645750b1b
rebrand MDE and add proper channel and event data
2022-03-09 08:37:52 +01:00
827c550c52
Created script adding_uuid.py
2022-03-08 02:36:57 -05:00
aaa4258a40
Updated ossemDM.py and created adding_uuid.py
...
Solved issue #40 : using script adding_uuid.py, added ids to every relationship
Solved issue #44 : use case mitre --> techniques to event mapping json and yaml only includes techniques with events and it validates if event platform is in technique platforms
2022-03-08 02:36:12 -05:00
1d109d3958
Updated Files based on PR #38
...
Updated files and relationships based on comments added to PR #38 from @rubinatorz
2022-03-07 22:01:11 -05:00
649f2a2655
Merge pull request #38 from rubinatorz/win_events
...
Contribution of Windows events. Also included some small fixes.
2022-03-07 00:12:05 -05:00
a453ae9836
Merge pull request #41 from H1L021/main
...
Adding process_searched_ldap.yml
2022-03-01 08:25:57 -08:00
0c37ba4ffc
Added MS Defender for Endpoint
2022-03-01 17:24:29 +01:00
e6c6d3cbba
Update process_searched_ldap.yml
...
Corrected data_components
2022-03-01 17:07:39 +01:00
Jose Rodriguez