- host --> device
- windows registry key --> registry
- windows registry key value --> registry
- logon session --> logon
- Merged Windows Registry Key and Windows Registry Key Value under Registry
- Still need to update techniques to event mapping files (Use Cases): TAXII server not working when making this commit.
Update of Schema to align with OSSEM-DD:
- log_source field instead of log_provider and log_channel
- platform field: Windows to windows, Linux to linux, Sysmon to sysmon
Update of ossemDM.py:
- added filter_in to attack_events_mapping.csv
- update based on new schema (lower case of platform field)
There is no need to add relationship id at the beginning of a yaml file when creating a PR.
The script will add the id based on current year and current relationships ids
Solved issue #40 : using script adding_uuid.py, added ids to every relationship
Solved issue #44 : use case mitre --> techniques to event mapping json and yaml only includes techniques with events and it validates if event platform is in technique platforms
* ossem_attack_dm_to_xml: It creates XPath queries in xml format per ATT&CK data source, based on OSSEM Detection Relationships
* ossem_attack_dm_to_azure_json: It creates a json file that aggregates XPath queries in xml format, based on OSSEM Detection Relationships
- ATT&CK files under docs folder:
* Yaml file with all data sources from ATT&CK
* Yaml file with OSSEM relationships and security events mapped to ATT&CK sources
* Markdown file with ATT&CK data Sources Definition
* Markdown file with OSSEM relationships and security events mapped to ATT&CK data sources
* CVS file with OSSEM relationships and security events mapped to ATT&CK data sources
- Relationships folder: yaml files that aggregates all OSSEM Relationships (mapped and not mapped to ATT&CK)
- docs/data_model folder: Markdown file with all OSSEM Relationships (mapped and not mapped to ATT&CK)
- Templates and Scripts updated
- we will need to review and update names and links for website
- Updating ATT&CK data sources and components
- Adding new relationships and events mapping
- Updating Python Script to create Relationships Yaml files
Jose Rodriguez