format: jb-book
root: intro
parts:
- caption: Data Dictionaries
  chapters:
  - file: dd/intro
  - file: dd/guidelines/intro
    sections:
    - file: dd/guidelines/contributing_data_dictionaries
    - file: dd/guidelines/authoring_data_dictionaries
  - file: dd/notebooks/intro
    sections:
    - file: dd/notebooks/security_events_correlation
  - file: dd/dictionaries/linux/intro
    sections:
    - file: dd/dictionaries/linux/sysmon/intro
      sections:
      - file: dd/dictionaries/linux/sysmon/event-1
      - file: dd/dictionaries/linux/sysmon/event-11
      - file: dd/dictionaries/linux/sysmon/event-16
      - file: dd/dictionaries/linux/sysmon/event-23
      - file: dd/dictionaries/linux/sysmon/event-3
      - file: dd/dictionaries/linux/sysmon/event-4
      - file: dd/dictionaries/linux/sysmon/event-5
      - file: dd/dictionaries/linux/sysmon/event-9
- caption: Common Data Model
  chapters:
  - file: cdm/intro
  - file: cdm/guidelines/intro
    sections:
    - file: cdm/guidelines/entity_structure
    - file: cdm/guidelines/table_structure
    - file: cdm/guidelines/data_types
    - file: cdm/guidelines/domain_or_hostname_or_fqdn
    - file: cdm/guidelines/source_or_destination_or_target
  - file: cdm/entities/intro
    sections:
    - file: cdm/entities/alert
    - file: cdm/entities/any
    - file: cdm/entities/certificate
    - file: cdm/entities/cloud
    - file: cdm/entities/destination
    - file: cdm/entities/destination_nat
    - file: cdm/entities/device
    - file: cdm/entities/dns
    - file: cdm/entities/etl
    - file: cdm/entities/event
    - file: cdm/entities/file
    - file: cdm/entities/geo
    - file: cdm/entities/group
    - file: cdm/entities/hash
    - file: cdm/entities/http
    - file: cdm/entities/ip
    - file: cdm/entities/kerberos
    - file: cdm/entities/logon
    - file: cdm/entities/mac
    - file: cdm/entities/meta
    - file: cdm/entities/module
    - file: cdm/entities/network
    - file: cdm/entities/pipe
    - file: cdm/entities/port
    - file: cdm/entities/process
    - file: cdm/entities/registry
    - file: cdm/entities/rule
    - file: cdm/entities/source
    - file: cdm/entities/source_nat
    - file: cdm/entities/target
    - file: cdm/entities/threat
    - file: cdm/entities/tls
    - file: cdm/entities/url
    - file: cdm/entities/user
    - file: cdm/entities/user_agent
  - file: cdm/tables/intro
    sections:
    - file: cdm/tables/network_session
- caption: Detection Model
  chapters:
  - file: dm/intro
  - file: dm/ossem_relationships_to_events
  - file: dm/mitre_attack/intro
    sections:
    - file: dm/mitre_attack/attack_techniques_to_events
    - file: dm/mitre_attack/attack_ds_events_mappings