admin/OTRF-OSSEM-DM
1
0
Fork 0
mirror of https://github.com/OTRF/OSSEM-DM synced 2026-06-08 12:05:55 +00:00
Code Issues Packages Projects Releases Wiki Activity
164 Commits 2 Branches 0 Tags
developer
Commit Graph

13 Commits

Author SHA1 Message Date
Jose Rodriguez ed1cbddce4 General update on relationships 
- updated numerical event_id to string.
- alignment with OSSEM-DD and readme description
 2022-09-22 13:07:27 -04:00
Jose Rodriguez c9dccda43e Updated Windows Security Auditing Relationships 
- Added Channel field
- Added references (URL) for Security auditing and sysmon events
- did not run python script. Will do after adding channel field for all events
 2022-09-21 23:40:42 -04:00
Jose Rodriguez cf5bd31ca3 Updated Windows Sysmon Relationships 
- Updated log_source to Microsoft-Windows-SysmonMicrosoft-Windows-Sysmon
- added channel: Microsoft-Windows-Sysmon/Operational
- Did not run python script. Will do after adding channel field
 2022-09-20 10:15:35 -04:00
Jose Rodriguez e2c9f58d10 attack data source name to lower case in all relationships 
Also updated all aggregated files
 2022-06-28 12:06:08 -04:00
Jose Rodriguez 0251be6fc9 Merge branch 'pr/43' into developer 2022-06-27 18:40:01 -04:00
Jose Rodriguez f63734851c Update of Schema for Microsoft Defender for Endpoint event logs 
Removed audit category, log_channel
Changed log_provider for log_source (Match OSSEM-DD)
Using filter_in section to describe the ActionType field
Added event version 1
 2022-06-24 11:51:22 -04:00
Jose Rodriguez 18dda0771e Updated AWS, Sysmon and Security relationships: log_provider & log_source 
AWS & Sysmon: Deleted log_provider
Security: log_source: Microsoft-Windows-Security-Auditing
 2022-05-03 13:41:43 -04:00
Jose Rodriguez ed5982b0f2 Updated All Sysmon Relations (Provider/Source) 
log_provider: Microsoft-Windows-Sysmon/Operational
log_source: Sysmon

log_provider: Linux-Sysmon/Operational
log_source: Sysmon
 2022-05-03 10:51:49 -04:00
Jose Rodriguez 3af9307bed Adding Event_Version field to security events Part 1 of 2 2022-04-28 13:01:16 -04:00
Jose Rodriguez aaa4258a40 Updated ossemDM.py and created adding_uuid.py 
Solved issue #40 : using script adding_uuid.py, added ids to every relationship
Solved issue #44 : use case mitre --> techniques to event mapping json and yaml only includes techniques with events and it validates if event platform is in technique platforms
 2022-03-08 02:36:12 -05:00
Swann Legras 7378cf86f7 reusing same syntax as in ossem dd 2022-02-08 19:16:47 +01:00
Olaf Hartong 351d7ab792 added tons of defender for endpoint and some sysmon events 2021-06-28 13:44:29 +02:00
Jose Rodriguez 1c3563f9e3 Mapping Sysmon 8 - CreateRemoteThread 
- Process modified Process
- Process executed Api Call
 2021-05-04 00:46:33 -04:00