Skip to content

Commit

Permalink
Updated parser and removed lab
Browse files Browse the repository at this point in the history
  • Loading branch information
netevert committed Nov 28, 2024
1 parent d583cbf commit f52034c
Show file tree
Hide file tree
Showing 18 changed files with 34 additions and 1,964 deletions.
6 changes: 2 additions & 4 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,12 +14,10 @@ Sentinel ATT&CK aims to simplify the rapid deployment of a threat hunting capabi

### Overview
Sentinel ATT&CK provides the following tools:
- An [ARM template](https://github.com/BlueTeamToolkit/sentinel-attack/blob/master/azuredeploy.json) to automatically deploy Sentinel ATT&CK to your Azure environment
- A [Sysmon configuration file](https://github.com/BlueTeamToolkit/sentinel-attack/blob/master/sysmonconfig.xml) compatible with Azure Sentinel and mapped to specific ATT&CK techniques
- A [Sysmon log parser](https://github.com/BlueTeamToolkit/sentinel-attack/blob/master/parser/Sysmon-OSSEM.txt) mapped against the [OSSEM](https://github.com/Cyb3rWard0g/OSSEM) data model
- An [ARM template](https://github.com/BlueTeamToolkit/sentinel-attack/blob/master/azuredeploy.json) to automatically deploy Sentinel ATT&CK to your Azure environment
- A [Sysmon log parser](https://github.com/BlueTeamToolkit/sentinel-attack/blob/master/parser/Sysmon-OSSEM.txt) mapped against the [OSSEM](https://github.com/Cyb3rWard0g/OSSEM) data model and compatible with the [Sysmon Modular XML configuration file](https://github.com/olafhartong/sysmon-modular/blob/master/sysmonconfig.xml)
- 117 ready-to-use Kusto [detection rules](https://github.com/BlueTeamToolkit/sentinel-attack/tree/master/detections) covering 156 ATT&CK techniques
- A [Sysmon threat hunting workbook](https://github.com/BlueTeamToolkit/sentinel-attack/tree/master/hunting) inspired by the [Threat Hunting App](https://splunkbase.splunk.com/app/4305/) for Splunk to help simplify threat hunts
- A [Terraform](https://www.terraform.io/) script to provision a lab to test Sentinel ATT&CK
- Comprehensive guidance to help you use the materials in this repository

### Usage
Expand Down
117 changes: 0 additions & 117 deletions lab/files/create-ad.ps1

This file was deleted.

2 changes: 0 additions & 2 deletions lab/files/dns_whitelist.csv

This file was deleted.

2 changes: 0 additions & 2 deletions lab/files/file_access_whitelist.csv

This file was deleted.

2 changes: 0 additions & 2 deletions lab/files/file_create_whitelist.csv

This file was deleted.

2 changes: 0 additions & 2 deletions lab/files/image_load_whitelist.csv

This file was deleted.

126 changes: 0 additions & 126 deletions lab/files/install-utilities.ps1

This file was deleted.

2 changes: 0 additions & 2 deletions lab/files/network_whitelist.csv

This file was deleted.

2 changes: 0 additions & 2 deletions lab/files/pipe_whitelist.csv

This file was deleted.

2 changes: 0 additions & 2 deletions lab/files/process_access_whitelist.csv

This file was deleted.

2 changes: 0 additions & 2 deletions lab/files/process_create_whitelist.csv

This file was deleted.

2 changes: 0 additions & 2 deletions lab/files/registry_whitelist.csv

This file was deleted.

2 changes: 0 additions & 2 deletions lab/files/remote_thread_whitelist.csv

This file was deleted.

Loading

0 comments on commit f52034c

Please sign in to comment.