hunters-forge-OSSEM/detection_data_model

Detection Data Model

Description

This part of the project focuses on defining the required data in form of data objects and the relationships among each other needed to facilitate the creation of data analytics and validate the detection of adversary techniques. This is inspired by the awesome work of MITRE with their project https://car.mitre.org/wiki/Main_Page. The information needed for each data object is pulled from the entities defined in the https://github.com/Cyb3rWard0g/OSSEM/blob/master/common_information_model.

Sub Data Sets

tables	Description	Tags
Host Object Relationships	None
Data Object Relationships	None
Process Object Relationships	None
User Object Relationships	None

References

• CAR Analytics
• Common Information Model
• STIX Cybox ObjectRelationshipVOcab-1.1
• Cybox Object
• STIX Version 2.0. Part 4 - Cyber Observable Object
• Finding Cyber Threats with ATTCK Based Analytics
• CAR Analytics Data Model
• Quantifying your hunt - not your parent's red teaming