updated Docs and Detection Model

+ new submodule (Detection Model)
MyIBGit · Oct 21, 2020 · 29ec838 · 29ec838
1 parent 22015da
commit 29ec838
Show file tree

Hide file tree

Showing 22 changed files with 6 additions and 5,331 deletions.
diff --git a/.gitmodules b/.gitmodules
@@ -2,3 +2,6 @@
  path = OSSEM-CDM
  url = https://github.com/OTRF/OSSEM-CDM
  branch = master
+[submodule "OSSEM-DM"]
+ path = OSSEM-DM
+ url = https://github.com/OTRF/OSSEM-DM
diff --git a/OSSEM-DM b/OSSEM-DM
diff --git a/README.md b/README.md
@@ -31,14 +31,14 @@ There are three main folders:
  * Contains specific information about several security event logs organized by operating system and their respective data providers
  * Each dictionary describes a single event log and its corresponding event field names
  * It provides the foundational concepts to create a data wiki in an organization.
-* **Detection Data Model (DDM)**:
+* **Detection Model (DM)**:
  * Focuses on defining the required data in form of data objects and relationships among each other needed to facilitate the creation of data analytics and validate the detection of adversary techniques
  * Developed initially to extend the definitions of ATT&CK Data Sources.
  * [MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data](https://youtu.be/QCDBjFJ_C3g)
  * [MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate Your Data Analytics!](https://youtu.be/eM0c_Gil-38)
  * Initial work in this project has been migrated to ATT&CK and improved by [@Cyb3rPandah](https://twitter.com/Cyb3rPandaH)
  * [Defining ATT&CK Data Sources, Part I: Enhancing the Current State](https://medium.com/mitre-attack/defining-attack-data-sources-part-i-4c39e581454f)
- * We are currently extending the model to map security events to the relationships identified in ATT&CK.
+ * This part of the project is an extension of the [ATT&CK Data Sources Objects](https://github.com/mitre-attack/attack-datasources) repo.
 
 # Author
 

diff --git a/attack_data_sources/README.md b/attack_data_sources/README.md
diff --git a/attack_data_sources/event-mappings/Authentication_logs.yml b/attack_data_sources/event-mappings/Authentication_logs.yml
diff --git a/attack_data_sources/event-mappings/DLL_monitoring.yml b/attack_data_sources/event-mappings/DLL_monitoring.yml
diff --git a/attack_data_sources/event-mappings/DNS_records.yml b/attack_data_sources/event-mappings/DNS_records.yml