infosecn1nja
/
DeTTECT
mirror of https://github.com/infosecn1nja/DeTTECT.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Added the data source as available (with a high DQ): Process use of network

master
Marcus Bakker 2019-07-30 20:51:18 +02:00
parent 1ea3547728
commit 6a23aae605
1 changed files with 11 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
sample-data/data-sources-endpoints.yaml
View File

@ -56,17 +56,17 @@ data_sources:
consistency: 0 consistency: 0
retention: 0 retention: 0
- data_source_name: Process use of network - data_source_name: Process use of network
date_registered: date_registered: 2019-07-25
date_connected: date_connected: 2019-07-25
products: [None] products: [Sysmon]
available_for_data_analytics: False available_for_data_analytics: True
comment: '' comment: ''
data_quality: data_quality:
device_completeness: 0 device_completeness: 5
data_field_completeness: 0 data_field_completeness: 5
timeliness: 0 timeliness: 5
consistency: 0 consistency: 5
retention: 0 retention: 5
- data_source_name: Windows Registry - data_source_name: Windows Registry
date_registered: 2019-03-01 date_registered: 2019-03-01
date_connected: 2017-02-01 date_connected: 2017-02-01
@ -620,7 +620,8 @@ data_sources:
consistency: 5 consistency: 5
retention: 4 retention: 4
exceptions: exceptions:
# Adding a technique ID below will result in removing that technique in the heat map (meaning not enough data source are available for proper detection). # Adding a technique ID below will result in removing that technique in the heat map (meaning not enough data source or quality is available for proper detection).
# Please note that the below is just an example, many more can exists. # Please note that the below is just an example, many more can exists.
# Filling in the key-value pair name is optional.
- technique_id: T1130 - technique_id: T1130
name: Install Root Certificate name: Install Root Certificate