Data Dictionaries

Introduction
Guidelines
- Contributing Guide
- Authoring Guide
Notebooks
- Correlating Windows Security Auditing
linux dictionaries
- sysmon events

Common Data Model

Introduction
Guidelines
Entities
- alert
- any
- certificate
- cloud
- destination
- destination_nat
- device
- dns
- etl
- event
- file
- geo
- group
- hash
- http
- ip
- kerberos
- logon
- mac
- meta
- module
- network
- pipe
- port
- process
- registry
- rule
- source
- source_nat
- target
- threat
- tls
- url
- user
- user_agent
Tables
- network_session

Detection Model

Introduction
Relationships to Events
MITRE ATT&CK
- ATT&CK Techniques to Security Events
- ATT&CK DS Event Mappings

Powered by Jupyter Book

Notebooks

Notebooks¶

previous

Authoring Guide

next

Correlating Windows Security Auditing

By Roberto Rodriguez @Cyb3rWard0g
© Copyright 2021.