Introduction

This part of the project focuses on defining the required data in form of data objects and the relationships among each other needed to facilitate the creation of data analytics and validate the detection of adversary techniques. We have also extended this concept to the MITRE-ATT&CK framework here.

Available documents

File

Description

OSSEM Event Mappings (YAML file)

Security event logs mapped to OSSEM relationships (Includes ATT&CK data sources metadata)

ATT&CK Event Mappings (MD file)

Security event logs mapped to ATT&CK Data Sources Objects

ATT&CK Event Mappings (YAML file)

Security event logs mapped to ATT&CK Data Sources Objects

ATT&CK Event Mappings (CSV file)

Security event logs mapped to ATT&CK Data Sources Objects