You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Sentinel ATT&CK aims to simplify the rapid deployment of a threat hunting capability that leverages Sysmon and MITRE ATT&CK on Azure Sentinel.
9
+
Sentinel ATT&CK aims to simplify the rapid deployment of a threat hunting capability that leverages Sysmon and [MITRE ATT&CK](https://attack.mitre.org/) on Azure Sentinel.
10
10
11
11
**DISCLAIMER:** This tool is not a magic bullet. It will require tuning and real investigative work to be truly effective in your environment.
- A [dashboard](https://github.com/BlueTeamToolkit/sentinel-attack/blob/master/dashboards/attack_telemetry.json) to monitor execution of ATT&CK techniques
18
-
- A [Sysmon configuration file](https://github.com/BlueTeamToolkit/sentinel-attack/blob/master/sysmonconfig.xml) mapped to specific ATT&CK techniques
16
+
Sentinel ATT&CK provides the following set of tools:
17
+
- A [Sysmon configuration file](https://github.com/BlueTeamToolkit/sentinel-attack/blob/master/sysmonconfig.xml) compatible with Azure Sentinel and mapped to specific ATT&CK techniques
19
18
- A [Sysmon log parser](https://github.com/BlueTeamToolkit/sentinel-attack/blob/master/parsers/Sysmon-OSSEM.txt) mapped against the [OSSEM](https://github.com/Cyb3rWard0g/OSSEM) data model
20
-
- 117 Kusto [detection rules](https://github.com/BlueTeamToolkit/sentinel-attack/tree/master/detections) mapped against ATT&CK
21
-
- A [Terraform](https://www.terraform.io/) script to provision a Sentinel ATT&CK test lab in Azure
22
-
-[Hunting Jupyter notebooks](https://github.com/BlueTeamToolkit/sentinel-attack/tree/master/hunting/notebooks) and [Azure workbooks](https://github.com/BlueTeamToolkit/sentinel-attack/tree/master/hunting/workbooks) to assist with process drill-down
23
-
- Guides to help you leverage the materials in this repository
19
+
- A [dashboard](https://github.com/BlueTeamToolkit/sentinel-attack/blob/master/dashboards/attack_telemetry.json) providing an overview of ATT&CK techniques executed on your Azure environment
- A [Hunting Jupyter notebook](https://github.com/BlueTeamToolkit/sentinel-attack/tree/master/hunting/notebooks) to assist with process drill-downs
22
+
-[Azure threat hunting workbooks](https://github.com/BlueTeamToolkit/sentinel-attack/tree/master/hunting/workbooks) inspired by the [Threat Hunting App](https://splunkbase.splunk.com/app/4305/) for Splunk to help simplify your threat hunts
23
+
- A [Terraform](https://www.terraform.io/) script to provision a lab to test Sentinel ATT&CK
24
+
- Comprehensive guides to help you use the materials in this repository
24
25
25
26
### Usage
26
-
Head over to the [wiki](https://github.com/BlueTeamLabs/sentinel-attack/wiki) to learn how to deploy Sentinel ATT&CK.
27
+
Head over to the [WIKI](https://github.com/BlueTeamLabs/sentinel-attack/wiki) to learn how to deploy and run Sentinel ATT&CK.
27
28
28
-
A copy of the DEF CON 27 presentation introducing Sentinel ATT&CK can be found [here](https://cloud-village.org/#talks?olafedoardo) and [here](https://github.com/BlueTeamToolkit/sentinel-attack/tree/master/docs/DEFCON_attacking_the_sentinel.pdf).
29
-
30
-
### ATT&CK coverage
31
-
32
-
Sentinel ATT&CK's detection rules cover a total of 156 ATT&CK techniques:
A copy of the DEF CON 27 cloud village presentation introducing Sentinel ATT&CK can be found [here](https://cloud-village.org/#talks?olafedoardo) and [here](https://github.com/BlueTeamToolkit/sentinel-attack/tree/master/docs/DEFCON_attacking_the_sentinel.pdf).
35
30
36
31
### Contributing
37
32
As this repository is constantly being updated and worked on, if you spot any problems we warmly welcome pull requests or submissions on the issue tracker.
@@ -40,11 +35,11 @@ As this repository is constantly being updated and worked on, if you spot any pr
0 commit comments