admin/OTRF-OSSEM-DM
1
0
Fork 0
mirror of https://github.com/OTRF/OSSEM-DM synced 2026-06-08 12:05:55 +00:00
Code Issues Packages Projects Releases Wiki Activity
164 Commits 2 Branches 0 Tags
developer
Commit Graph

19 Commits

Author SHA1 Message Date
Jose Rodriguez ed1cbddce4 General update on relationships 
- updated numerical event_id to string.
- alignment with OSSEM-DD and readme description
 2022-09-22 13:07:27 -04:00
Jose Rodriguez c67bcceefc Updated PowerShell Event 
- Updated channel and log_source fields
- added .DS_Store to gitignore
 2022-09-22 10:20:13 -04:00
Jose Rodriguez c9dccda43e Updated Windows Security Auditing Relationships 
- Added Channel field
- Added references (URL) for Security auditing and sysmon events
- did not run python script. Will do after adding channel field for all events
 2022-09-21 23:40:42 -04:00
Jose Rodriguez cf5bd31ca3 Updated Windows Sysmon Relationships 
- Updated log_source to Microsoft-Windows-SysmonMicrosoft-Windows-Sysmon
- added channel: Microsoft-Windows-Sysmon/Operational
- Did not run python script. Will do after adding channel field
 2022-09-20 10:15:35 -04:00
Jose Rodriguez e2c9f58d10 attack data source name to lower case in all relationships 
Also updated all aggregated files
 2022-06-28 12:06:08 -04:00
Jose Rodriguez a1ee4c7615 Updated schema for Powershell events 2022-06-28 07:54:05 -04:00
Jose Rodriguez 0251be6fc9 Merge branch 'pr/43' into developer 2022-06-27 18:40:01 -04:00
Jose Rodriguez f63734851c Update of Schema for Microsoft Defender for Endpoint event logs 
Removed audit category, log_channel
Changed log_provider for log_source (Match OSSEM-DD)
Using filter_in section to describe the ActionType field
Added event version 1
 2022-06-24 11:51:22 -04:00
Jose Rodriguez 18dda0771e Updated AWS, Sysmon and Security relationships: log_provider & log_source 
AWS & Sysmon: Deleted log_provider
Security: log_source: Microsoft-Windows-Security-Auditing
 2022-05-03 13:41:43 -04:00
Jose Rodriguez ed5982b0f2 Updated All Sysmon Relations (Provider/Source) 
log_provider: Microsoft-Windows-Sysmon/Operational
log_source: Sysmon

log_provider: Linux-Sysmon/Operational
log_source: Sysmon
 2022-05-03 10:51:49 -04:00
Jose Rodriguez c0c9cf47e2 Adding Event_Version field to security events Part 2 of 2 2022-04-29 23:22:23 -04:00
Jose Rodriguez 3af9307bed Adding Event_Version field to security events Part 1 of 2 2022-04-28 13:01:16 -04:00
Jose Rodriguez aaa4258a40 Updated ossemDM.py and created adding_uuid.py 
Solved issue #40 : using script adding_uuid.py, added ids to every relationship
Solved issue #44 : use case mitre --> techniques to event mapping json and yaml only includes techniques with events and it validates if event platform is in technique platforms
 2022-03-08 02:36:12 -05:00
Swann Legras 7378cf86f7 reusing same syntax as in ossem dd 2022-02-08 19:16:47 +01:00
Roberto Rodriguez 65b5974378 updated relationships with Sysmon for Linux and updated use cases files 2021-10-18 16:05:53 -04:00
Olaf Hartong 351d7ab792 added tons of defender for endpoint and some sysmon events 2021-06-28 13:44:29 +02:00
Cyb3rPandaH 88d6753398 Mapping MDATP DeviceProcessEvents and DeviceFileEvents tables 
Relationships:
- process created file
- process created process
- process executed command
- process modified file
- user created file
- user created process
- user executed command
- user modified file
 2021-04-27 00:32:53 -04:00
Cyb3rPandaH 5df959dd54 Updating Relationships yaml files 
- Updating ATT&CK data sources and components
- Adding new relationships and events mapping
- Updating Python Script to create Relationships Yaml files
 2021-04-26 22:38:15 -04:00
Roberto Rodriguez 5b9980f1cc First attempt to create files for each relationship 
+ Yaml files
+ Pytho script to process current data sources yaml
 2021-02-23 02:18:58 -05:00