- host --> device
- windows registry key --> registry
- windows registry key value --> registry
- logon session --> logon
- Merged Windows Registry Key and Windows Registry Key Value under Registry
- Still need to update techniques to event mapping files (Use Cases): TAXII server not working when making this commit.
- log_source: Microsoft-Windows-Windows Firewall With Advanced Security
- issue created in OSSEM-DD: Creation of dictionaries required - https://github.com/OTRF/OSSEM-DD/issues/39
Update of Schema to align with OSSEM-DD:
- log_source field instead of log_provider and log_channel
- platform field: Windows to windows, Linux to linux, Sysmon to sysmon
Update of ossemDM.py:
- added filter_in to attack_events_mapping.csv
- update based on new schema (lower case of platform field)
There is no need to add relationship id at the beginning of a yaml file when creating a PR.
The script will add the id based on current year and current relationships ids
Solved issue #40 : using script adding_uuid.py, added ids to every relationship
Solved issue #44 : use case mitre --> techniques to event mapping json and yaml only includes techniques with events and it validates if event platform is in technique platforms
Jose Rodriguez