Commit Graph

12 Commits

Author SHA1 Message Date
Jose Rodriguez ed1cbddce4 General update on relationships
- updated numerical event_id to string.
- alignment with OSSEM-DD and readme description
2022-09-22 13:07:27 -04:00
Jose Rodriguez c67bcceefc Updated PowerShell Event
- Updated channel and log_source fields
- added .DS_Store to gitignore
2022-09-22 10:20:13 -04:00
Jose Rodriguez c7f3a2ad9d Aligning source and target entities with OSSEM-CDM
- host --> device
- windows registry key --> registry
- windows registry key value --> registry
- logon session --> logon
- Merged Windows Registry Key and Windows Registry Key Value under Registry
- Still need to update techniques to event mapping files (Use Cases): TAXII server not working when making this commit.
2022-08-05 09:42:40 -04:00
Jose Rodriguez e2c9f58d10 attack data source name to lower case in all relationships
Also updated all aggregated files
2022-06-28 12:06:08 -04:00
Jose Rodriguez a1ee4c7615 Updated schema for Powershell events 2022-06-28 07:54:05 -04:00
Jose Rodriguez 0251be6fc9 Merge branch 'pr/43' into developer 2022-06-27 18:40:01 -04:00
Jose Rodriguez f63734851c Update of Schema for Microsoft Defender for Endpoint event logs
Removed audit category, log_channel
Changed log_provider for log_source (Match OSSEM-DD)
Using filter_in section to describe the ActionType field
Added event version 1
2022-06-24 11:51:22 -04:00
Jose Rodriguez 3af9307bed Adding Event_Version field to security events Part 1 of 2 2022-04-28 13:01:16 -04:00
Jose Rodriguez aaa4258a40 Updated ossemDM.py and created adding_uuid.py
Solved issue #40 : using script adding_uuid.py, added ids to every relationship
Solved issue #44 : use case mitre --> techniques to event mapping json and yaml only includes techniques with events and it validates if event platform is in technique platforms
2022-03-08 02:36:12 -05:00
Swann Legras 7378cf86f7 reusing same syntax as in ossem dd 2022-02-08 19:16:47 +01:00
Olaf Hartong 351d7ab792 added tons of defender for endpoint and some sysmon events 2021-06-28 13:44:29 +02:00
Cyb3rPandaH 5df959dd54 Updating Relationships yaml files
- Updating ATT&CK data sources and components
- Adding new relationships and events mapping
- Updating Python Script to create Relationships Yaml files
2021-04-26 22:38:15 -04:00