Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Standardize Formatting, renamed some files #4

Open
wants to merge 8 commits into
base: main
Choose a base branch
from

Conversation

jaimeatwork
Copy link

@jaimeatwork jaimeatwork commented Sep 9, 2021

Ignoring whitespace, this mostly does cleanup of the original repository, standardizing the schema of events, adding techniques inside each of the events, and renaming Privileges Elevation to align with MITRE's Privilege Escalation. I removed whitespace in Tactic names to ease parsing, but this is mostly the original data set.

The schema now looks like this

{
    "tactic": "Collection",
    "techniques": [
    "T1000",
    "T1001"
    ],
    "documents": [
    < original content from elastic events, unchanged except for above >
    ]
}

I had thought about adding a key for references, but felt it would be better to handle that separately.

I tried my best to map events to techniques, but MITRE doesn't have full coverage of the events you documented so I used the closest appropriate ones I could.

Please let me know if you'd like to see any changes, and thanks for taking the time to review.

jaimeatwork and others added 6 commits September 2, 2021 14:28
* updating collection techniques

* cleaned up formatting, completed credential_access

* updated defense_Evasion

* adding discovery

* checkpoint

* Adding execution

* adding lateral_movement

* adding persistence

* adding priv esc

* cleanup
@remotephone
Copy link

This is messy because of the renamed files. A git diff will show the complete file deleted and new one created for everything in a renamed folder. 😬 sorry.

I following the instructions here and used git diff mainRepo/main..HEAD --ignore-all-space from my repo to compare branches, I think you would replace mainRepo with like forkedRepo and use the URL of my fork to do the inverse of that command, something like git diff HEAD..forkedRepo --ignore-all-space to do the cleanest diff.

@jaimeatwork
Copy link
Author

lol woops, sorry the above is me, all the same still applies :)

@jaimeatwork
Copy link
Author

Closes #2

I just added some tests that can be run with pytest. The first one ensures everything is json, the second one tests the schema using Schema.

@jaimeatwork
Copy link
Author

howdy @sbousseaden, I understand this is a rather large pull request, please let me know if you'd like me to break this up in any way, I'd be happy to do whatever is best for you. I don't mind continuing along on my fork, but I would like to do things like contribute additional logs, tooling and documentation.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants