admin/hunters-forge-OSSEM
1
0
Fork 0
mirror of https://github.com/hunters-forge/OSSEM synced 2026-06-08 14:44:11 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
dictionary_versioning
hunters-forge-OSSEM/docs/_build/html/intro.html
T
Roberto Rodriguez cc07c0e435 Updated docs adding entities and tables concept
2020-07-15 04:48:30 -04:00

326 lines
17 KiB
HTML
Raw Permalink Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta charset="utf-8" />
<title>OSSEM &#8212; The OSSEM Project</title>
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.11.2/css/all.min.css" integrity="sha384-KA6wR/X5RY4zFAHpv/CnoG2UW1uogYfdnP67Uv7eULvTveboZJg0qUpmJZb5VqzN" crossorigin="anonymous">
<link href="_static/css/index.css" rel="stylesheet">
<link rel="stylesheet" href="_static/sphinx-book-theme.css" type="text/css" />
<link rel="stylesheet" href="_static/pygments.css" type="text/css" />
<link rel="stylesheet" type="text/css" href="_static/togglebutton.css" />
<link rel="stylesheet" type="text/css" href="_static/copybutton.css" />
<link rel="stylesheet" type="text/css" href="_static/mystnb.css" />
<link rel="stylesheet" type="text/css" href="_static/jupyter-sphinx.css" />
<script id="documentation_options" data-url_root="./" src="_static/documentation_options.js"></script>
<script src="_static/sphinx-book-theme.js"></script>
<script src="_static/jquery.js"></script>
<script src="_static/underscore.js"></script>
<script src="_static/doctools.js"></script>
<script src="_static/language_data.js"></script>
<script src="_static/togglebutton.js"></script>
<script src="_static/clipboard.min.js"></script>
<script src="_static/copybutton.js"></script>
<script src="_static/mystnb.js"></script>
<script src="_static/sphinx-book-theme.js"></script>
<script >var togglebuttonSelector = '.toggle, .secondtoggle, .tag_hide_input div.cell_input, .tag_hide-input div.cell_input, .tag_hide_output div.cell_output, .tag_hide-output div.cell_output, .tag_hide_cell.cell, .tag_hide-cell.cell';</script>
<script src="https://unpkg.com/@jupyter-widgets/html-manager@^0.18.0/dist/embed.js"></script>
<script async="async" src="https://unpkg.com/thebelab@latest/lib/index.js"></script>
<script async="async" src="_static/thebelab.js"></script>
<link rel="canonical" href="https://ossemproject.com/intro.html" />
<link rel="shortcut icon" href="_static/favicon.ico"/>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="Introduction" href="dd/intro.html" />
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta name="docsearch:language" content="en">
<!-- Put requirejs at the end so it's always after bootstrap -->
<!-- TODO: remove this once https://github.com/pandas-dev/pydata-sphinx-theme/pull/149 is merged -->
<script src="https://cdnjs.cloudflare.com/ajax/libs/require.js/2.3.6/require.min.js"></script>
<!-- Opengraph tags -->
<meta property="og:url" content="https://ossemproject.com/intro.html" />
<meta property="og:type" content="article" />
<meta property="og:title" content="OSSEM" />
<meta property="og:description" content="OSSEM Open Source Love Open_Threat_Research Community The Open Source Security Events Metadata (OSSEM) is a community-led project that focuses primarily on th" />
<meta property="og:image" content="https://ossemproject.com/_static/logo.png" />
<meta name="twitter:card" content="summary">
</head>
<body data-spy="scroll" data-target="#bd-toc-nav" data-offset="80">
<div class="container-xl">
<div class="row">
<div class="col-12 col-md-3 bd-sidebar site-navigation show" id="site-navigation">
<div class="navbar-brand-box">
<a class="navbar-brand text-wrap" href="index.html">
<img src="_static/logo.png" class="logo" alt="logo">
<h1 class="site-logo" id="site-title">The OSSEM Project</h1>
</a>
</div>
<form class="bd-search d-flex align-items-center" action="search.html" method="get">
<i class="icon fas fa-search"></i>
<input type="search" class="form-control" name="q" id="search-input" placeholder="Search this book..." aria-label="Search this book..." autocomplete="off" >
</form>
<nav class="bd-links" id="bd-docs-nav" aria-label="Main navigation">
<ul class="nav sidenav_l1">
<li class="navbar-special">
<p class="margin-caption">Data Dictionaries</p>
</li>
<li class="">
<a href="dd/intro.html">Introduction</a>
</li>
<li class="">
<a href="dd/guidelines/intro.html">Guidelines</a>
</li>
<li class="navbar-special">
<p class="margin-caption">Common Data Model</p>
</li>
<li class="">
<a href="cdm/intro.html">Introduction</a>
</li>
<li class="">
<a href="cdm/guidelines/intro.html">Guidelines</a>
</li>
<li class="">
<a href="cdm/entities/intro.html">Entities</a>
</li>
<li class="">
<a href="cdm/tables/intro.html">Tables</a>
</li>
<li class="navbar-special">
<p class="margin-caption">ATT&CK Data Sources</p>
</li>
<li class="">
<a href="attack/windows/intro.html">Windows</a>
</li>
</ul>
</nav>
<p class="navbar_footer">Powered by <a href="https://jupyterbook.org">Jupyter Book</a></p>
</div>
<main class="col py-md-3 pl-md-4 bd-content overflow-auto" role="main">
<div class="row topbar fixed-top container-xl">
<div class="col-12 col-md-3 bd-topbar-whitespace site-navigation show">
</div>
<div class="col pl-2 topbar-main">
<button id="navbar-toggler" class="navbar-toggler ml-0" type="button" data-toggle="collapse" data-toggle="tooltip" data-placement="bottom" data-target=".site-navigation" aria-controls="navbar-menu" aria-expanded="true" aria-label="Toggle navigation" aria-controls="site-navigation" title="Toggle navigation" data-toggle="tooltip" data-placement="left">
<i class="fas fa-bars"></i>
<i class="fas fa-arrow-left"></i>
<i class="fas fa-arrow-up"></i>
</button>
<div class="dropdown-buttons-trigger">
<button id="dropdown-buttons-trigger" class="btn btn-secondary topbarbtn" aria-label="Download this page"><i class="fas fa-download"></i></button>
<div class="dropdown-buttons">
<!-- ipynb file if we had a myst markdown file -->
<!-- Download raw file -->
<a class="dropdown-buttons" href="_sources/intro.md.txt"><button type="button" class="btn btn-secondary topbarbtn" title="Download source file" data-toggle="tooltip" data-placement="left">.md</button></a>
<!-- Download PDF via print -->
<button type="button" id="download-print" class="btn btn-secondary topbarbtn" title="Print to PDF" onClick="window.print()" data-toggle="tooltip" data-placement="left">.pdf</button>
</div>
</div>
<!-- Edit this page -->
<a class="edit-button" href="https://github.com/hunters-forge/OSSEM/edit/master/docs/intro.md"><button type="button" class="btn btn-secondary topbarbtn" data-toggle="tooltip" data-placement="bottom" title="Edit this page"><i class="fas fa-pencil-alt"></i></button></a>
<!-- Full screen (wrap in <a> to have style consistency -->
<a class="full-screen-button"><button type="button" class="btn btn-secondary topbarbtn" data-toggle="tooltip" data-placement="bottom" onclick="toggleFullScreen()" title="Fullscreen mode"><i class="fas fa-expand"></i></button></a>
<!-- Launch buttons -->
</div>
<div class="d-none d-md-block col-md-2 bd-toc show">
<nav id="bd-toc-nav">
<ul class="nav section-nav flex-column">
</ul>
</nav>
<div class="tocsection editthispage">
<a href="https://github.com/hunters-forge/OSSEM/edit/master/docs/intro.md">
<i class="fas fa-pencil-alt"></i> Edit this page
</a>
</div>
</div>
</div>
<div id="main-content" class="row">
<div class="col-12 col-md-9 col-xxl-7 pl-md-3 pr-md-0">
<div>
<div class="section" id="ossem">
<h1>OSSEM<a class="headerlink" href="#ossem" title="Permalink to this headline"></a></h1>
<p><a class="reference external" href="https://github.com/ellerbrock/open-source-badges/"><img alt="Open Source Love" src="https://badges.frapsoft.com/os/v3/open-source.svg?v=103" /></a>
<img alt="Open_Threat_Research Community" src="https://img.shields.io/badge/Open_Threat_Research-Community-brightgreen.svg" /></p>
<p>The Open Source Security Events Metadata (OSSEM) is a community-led project that focuses primarily on the documentation and standardization of security event logs from diverse data sources and operating systems. Security events are documented in a dictionary format and can be used as a reference for projects like the ThreatHunter-Playbook while mapping data sources to data analytics used to validate the detection of adversarial techniques. In addition, the project provides a common information model (CIM) that can be used for data engineers during data normalization procedures to allow security analysts to query and analyze data across diverse data sources. Finally, the project also provides documentation about the structure and relationships identified in specific data sources to facilitate the development of data analytics.</p>
</div>
<div class="section" id="goals">
<h1>Goals<a class="headerlink" href="#goals" title="Permalink to this headline"></a></h1>
<ul class="simple">
<li><p>Define and share a common information model in order to improve the data standardization and transformation of security event logs</p></li>
<li><p>Define and share data structures and relationships identified in security events logs</p></li>
<li><p>Provide detailed information in a dictionary format about several security event logs to the community</p></li>
<li><p>Learn more about security event logs (Windows, Linux &amp; MacOS)</p></li>
<li><p>Have fun and think more about the data structure in your SIEM when it comes down to detection!!</p></li>
</ul>
</div>
<div class="section" id="project-structure">
<h1>Project Structure<a class="headerlink" href="#project-structure" title="Permalink to this headline"></a></h1>
<p>There are four main folders:</p>
<ul class="simple">
<li><p><strong>Common Information Model (CIM)</strong>:</p>
<ul>
<li><p>Facilitates the normalization of data sets by providing a standard way to parse security event logs</p></li>
<li><p>It is organized by specific entities associated with event logs and defined in more details by <strong>Data Dictionaries</strong>.</p></li>
<li><p>The definitions of each entity and its respective field names are mostly general descriptions that could help and expedite event logs parsing procedures.</p></li>
</ul>
</li>
<li><p><strong>Data Dictionaries</strong>:</p>
<ul>
<li><p>Contains specific information about several security event logs organized by operating system and their respective data sets</p></li>
<li><p>Each dictionary describes a single event log and its corresponding event field names</p></li>
<li><p>The difference between the <strong>Common Information Model</strong> folder and the data dictionaries is that in the CIM the field definitions are more general whereas in a data dictionary, each field name definition is unique to the specific event log.</p></li>
</ul>
</li>
<li><p><strong>Detection Data Model</strong>:</p>
<ul>
<li><p>Focuses on defining the required data in form of data objects and the relationships among each other needed to facilitate the creation of data analytics and validate the detection of adversary techniques</p></li>
<li><p>This is inspired by the awesome work of MITRE with their project <a class="reference external" href="https://car.mitre.org/wiki/Main_Page">CAR Analytics</a></p></li>
<li><p>The information needed for each data object is pulled from the entities defined in the <strong>Common Information Model</strong>.</p></li>
</ul>
</li>
<li><p><strong>ATTACK Data Sources</strong>:</p>
<ul>
<li><p>Focuses on the documentation of data sources suggested or associated with techniques defined in the <a class="reference external" href="https://attack.mitre.org/wiki/Technique_Matrix">Enterprise Matrix</a></p></li>
<li><p>In addition, here is where data sources will be mapped with specific data objects defined in the <strong>Detection Data Model</strong> part of the project with the main goal of creating a link between techniques, data sources and data analytics</p></li>
</ul>
</li>
</ul>
</div>
<div class="section" id="current-status-alpha">
<h1>Current Status: Alpha<a class="headerlink" href="#current-status-alpha" title="Permalink to this headline"></a></h1>
<p>The project is currently in an alpha stage, which means that the content is still changing. We welcome any feedback and suggestions to improve the project.</p>
</div>
<div class="section" id="projects-using-ossem">
<h1>Projects Using OSSEM<a class="headerlink" href="#projects-using-ossem" title="Permalink to this headline"></a></h1>
<ul class="simple">
<li><p><a class="reference external" href="https://github.com/Cyb3rWard0g/HELK">HELK</a> currently updating its pipeline configs</p></li>
</ul>
</div>
<div class="section" id="resources">
<h1>Resources<a class="headerlink" href="#resources" title="Permalink to this headline"></a></h1>
<ul class="simple">
<li><p><a class="reference external" href="https://cyberwardog.blogspot.com/2017/12/ready-to-hunt-first-show-me-your-data.html">Ready to hunt? First, Show me your data!</a></p></li>
<li><p><a class="reference external" href="https://docs.microsoft.com/en-us/windows/whats-new/whats-new-windows-10-version-1507-and-1511#bkmk-lsass">What’s new in Windows 10, versions 1507 and 1511</a></p></li>
<li><p><a class="reference external" href="https://www.microsoft.com/en-us/download/details.aspx?id=50034">Download Security Audit Events for Windows (Spreadsheet)</a></p></li>
<li><p><a class="reference external" href="https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings">Advanced Security Audit Policy Settings</a></p></li>
<li><p><a class="reference external" href="https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/monitoring-active-directory-for-signs-of-compromise#audit-account-management">Monitoring Active Directory for Signs of Compromise</a></p></li>
<li><p><a class="reference external" href="https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations">Audit Policy Recommendations</a></p></li>
<li><p><a class="reference external" href="https://docs.microsoft.com/en-us/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection">Use Windows Event Forwarding to help with intrusion detection</a></p></li>
<li><p><a class="reference external" href="https://docs.microsoft.com/en-us/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection#a-href-idbkmk-appendixaaappendix-a---minimum-recommended-minimum-audit-policy">Minimum recommended minimum audit policy</a></p></li>
<li><p><a class="reference external" href="https://github.com/MicrosoftDocs/windows-itpro-docs/tree/master/windows/security/threat-protection">Windows ITPro Docs - Threat Protection</a></p></li>
</ul>
</div>
<div class="section" id="author">
<h1>Author<a class="headerlink" href="#author" title="Permalink to this headline"></a></h1>
<ul class="simple">
<li><p>Roberto Rodriguez <a class="reference external" href="https://twitter.com/Cyb3rWard0g">&#64;Cyb3rWard0g</a></p></li>
</ul>
</div>
<div class="section" id="current-committers">
<h1>Current Committers<a class="headerlink" href="#current-committers" title="Permalink to this headline"></a></h1>
<ul class="simple">
<li><p>Jose Luis Rodriguez <a class="reference external" href="https://twitter.com/Cyb3rPandaH">&#64;Cyb3rPandaH</a></p></li>
<li><p>Nate Guagenti <a class="reference external" href="https://twitter.com/neu5ron">&#64;neu5ron</a></p></li>
<li><p>Fred Frey <a class="reference external" href="https://twitter.com/FryGuy2600">&#64;FryGuy2600</a></p></li>
<li><p>Ricardo Dias <a class="reference external" href="https://twitter.com/hxnoyd">&#64;hxnoyd</a></p></li>
</ul>
<div class="toctree-wrapper compound">
</div>
<div class="toctree-wrapper compound">
</div>
<div class="toctree-wrapper compound">
</div>
</div>
<script type="text/x-thebe-config">
{
requestKernel: true,
binderOptions: {
repo: "hunters-forge/OSSEM",
ref: "master",
},
codeMirrorConfig: {
theme: "abcdef",
mode: "python"
},
kernelOptions: {
kernelName: "python3",
path: "."
}
}
</script>
<script>kernelName = 'python3'</script>
</div>
</div>
</div>
<div class='prev-next-bottom'>
<a class='right-next' id="next-link" href="dd/intro.html" title="next page">Introduction</a>
</div>
<footer class="footer mt-5 mt-md-0">
<div class="container">
<p>
&copy; Copyright 2020.<br/>
Created using <a href="http://sphinx-doc.org/">Sphinx</a> 2.4.1.<br/>
</p>
</div>
</footer>
</main>
</div>
</div>
<script src="_static/js/index.js"></script>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink