General repo update #57
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Collaborator
Cyb3rPandaH
commented
Sep 24, 2022
Cyb3rPandaH
commented
- Updated main README file. It includes a description of the YAML structure and a reference example for contribution
- Added channel field in Windows related events (Security Auditing, PowerShell, Windows Firewall, Service Control Manager, and Event Log providers)
- Added references to security events
- Updated ossemDM.py script to include channel field
- Run updated ossemDM.py script to update all_relationships fiels and ATT&CK use case
- This PR closes Issue Uniquely identify Windows events for automated data collection #55
Added Documentation Format and Schema section. We are adding the `Channel` field to the schema. I need to add this field to yaml files.
added missing description in Notes
- Updated log_source to Microsoft-Windows-SysmonMicrosoft-Windows-Sysmon - added channel: Microsoft-Windows-Sysmon/Operational - Did not run python script. Will do after adding channel field
- Added Channel field - Added references (URL) for Security auditing and sysmon events - did not run python script. Will do after adding channel field for all events
- Updated channel and log_source fields - added .DS_Store to gitignore
- added channel and updated log_source fields - did not run python script. Will do after adding channel field for all events
- added channel field and updated log_source field - also added event version
- added channel field and updated log_source field - did not run python script. Will do after adding channel field for all events
- updated numerical event_id to string. - alignment with OSSEM-DD and readme description
- added field channel to yml, json, and csv files - updated all_ossem_relationships and attack files
- added channel field to output files
Updated README description
- Updated Sysmon log_source reference to Microsoft-Windows-Sysmon. Enable commands commands are now populated for Windows Sysmon events.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.