hunters-forge-OSSEM/attack_data_sources

MITRE ATT&CK

Description

This part of the OSSEM project focuses on the documentation of ATT&CK data sources suggested or associated with techniques defined in the https://attack.mitre.org/wiki/Technique_Matrix. In addition, here is where ATT&CK data sources will be mapped with specific sub data sources defined in the /detection_data_model with the main goal of creating a link between ATT&CK data sources and event logs.

Data source (Process Monitoring) mapped to specific event logs example

Sub Data Sets

tables	Description	Tags
Data Sources	None

References

• Enterprise Matrix
• Jupyter notebook to explore ATT&CK data sources
• ATT&CKcon 2018 - Slides and demos documents
• ATT&CK Data Sources mapped to Event Logs