Skip to content

Commit f52034c

Browse files
committed
Updated parser and removed lab
1 parent d583cbf commit f52034c

18 files changed

+34
-1964
lines changed

README.md

+2-4
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,10 @@ Sentinel ATT&CK aims to simplify the rapid deployment of a threat hunting capabi
1414

1515
### Overview
1616
Sentinel ATT&CK provides the following tools:
17-
- An [ARM template](https://github.com/BlueTeamToolkit/sentinel-attack/blob/master/azuredeploy.json) to automatically deploy Sentinel ATT&CK to your Azure environment
18-
- A [Sysmon configuration file](https://github.com/BlueTeamToolkit/sentinel-attack/blob/master/sysmonconfig.xml) compatible with Azure Sentinel and mapped to specific ATT&CK techniques
19-
- A [Sysmon log parser](https://github.com/BlueTeamToolkit/sentinel-attack/blob/master/parser/Sysmon-OSSEM.txt) mapped against the [OSSEM](https://github.com/Cyb3rWard0g/OSSEM) data model
17+
- An [ARM template](https://github.com/BlueTeamToolkit/sentinel-attack/blob/master/azuredeploy.json) to automatically deploy Sentinel ATT&CK to your Azure environment
18+
- A [Sysmon log parser](https://github.com/BlueTeamToolkit/sentinel-attack/blob/master/parser/Sysmon-OSSEM.txt) mapped against the [OSSEM](https://github.com/Cyb3rWard0g/OSSEM) data model and compatible with the [Sysmon Modular XML configuration file](https://github.com/olafhartong/sysmon-modular/blob/master/sysmonconfig.xml)
2019
- 117 ready-to-use Kusto [detection rules](https://github.com/BlueTeamToolkit/sentinel-attack/tree/master/detections) covering 156 ATT&CK techniques
2120
- A [Sysmon threat hunting workbook](https://github.com/BlueTeamToolkit/sentinel-attack/tree/master/hunting) inspired by the [Threat Hunting App](https://splunkbase.splunk.com/app/4305/) for Splunk to help simplify threat hunts
22-
- A [Terraform](https://www.terraform.io/) script to provision a lab to test Sentinel ATT&CK
2321
- Comprehensive guidance to help you use the materials in this repository
2422

2523
### Usage

lab/files/create-ad.ps1

-117
This file was deleted.

lab/files/dns_whitelist.csv

-2
This file was deleted.

lab/files/file_access_whitelist.csv

-2
This file was deleted.

lab/files/file_create_whitelist.csv

-2
This file was deleted.

lab/files/image_load_whitelist.csv

-2
This file was deleted.

lab/files/install-utilities.ps1

-126
This file was deleted.

lab/files/network_whitelist.csv

-2
This file was deleted.

lab/files/pipe_whitelist.csv

-2
This file was deleted.

lab/files/process_access_whitelist.csv

-2
This file was deleted.

lab/files/process_create_whitelist.csv

-2
This file was deleted.

lab/files/registry_whitelist.csv

-2
This file was deleted.

lab/files/remote_thread_whitelist.csv

-2
This file was deleted.

0 commit comments

Comments
 (0)