Detect Tactics, Techniques & Combat Threats
 
 
 
 
 
 
Go to file
Ruben Bouman 134f2064d0 Merge branch 'development' of https://github.com/marcusbakker/DeTTECT-private into development 2020-01-06 12:06:44 +01:00
sample-data Added a 'platform' key-value pair 2019-12-12 15:07:56 +01:00
threat-actor-data Multiple small changes (the listed techniques and/or assigned scores are unchanged) 2019-12-06 16:16:33 +01:00
Dockerfile Docker image failed to build (in v1.2.5 this was no issue). 2019-12-17 15:10:56 +01:00
LICENSE initial commit 2019-03-29 15:26:25 +01:00
README.md bumped the version to 1.2.6 2019-12-11 10:41:39 +01:00
constants.py bumped the version to 1.2.6 2019-12-11 10:41:39 +01:00
data_source_mapping.py Resolved issue #15 2020-01-06 12:00:27 +01:00
dettect.py Typo 2019-12-12 15:50:27 +01:00
eql_yaml.py fixed an issue that resulted in dates to be represented as strings 2019-12-05 15:44:36 +01:00
generic.py Added new functionality to support a platform key-value pair in a group YAML file. 2019-12-06 13:50:16 +01:00
group_mapping.py Added new functionality to support a platform key-value pair in a group YAML file. 2019-12-06 13:50:16 +01:00
health.py Fixed a bug that caused an invalid health error message. 2019-12-12 15:21:27 +01:00
interactive_menu.py Several small changes in some text. 2019-12-11 10:43:08 +01:00
requirements.txt Updated the package plotly to it latest version 2019-12-11 10:40:17 +01:00
scoring_table.xlsx Several small changes in some text. 2019-12-11 10:43:08 +01:00
technique_mapping.py The cumulative count was broken due to upgrade of Pandas to version 0.25.3 2019-12-05 10:37:11 +01:00
upgrade.py Added an extra check for a possible empty 'comment' key-value pair. 2019-08-20 11:13:25 +02:00

README.md

DeTT&CT

Detect Tactics, Techniques & Combat Threats

Latest version: 1.2.6

To get started with DeTT&CT, check out this page, our talk at hack.lu 2019 and our blog on:

DeTT&CT aims to assist blue teams using ATT&CK to score and compare data log source quality, visibility coverage, detection coverage and threat actor behaviours. All of which can help, in different ways, to get more resilient against attacks targeting your organisation. The DeTT&CT framework consists of a Python tool, YAML administration files and scoring tables for the different aspects.

DeTT&CT provides the following functionality:

  • Administrate and score the quality of your data sources.
  • Get insight on the visibility you have on for example endpoints.
  • Map your detection coverage.
  • Map threat actor behaviours.
  • Compare visibility, detections and threat actor behaviours to uncover possible improvements in detection and visibility. This can help you to prioritise your blue teaming efforts.

The coloured visualisations are created with the help of MITRE's ATT&CK™ Navigator.

Authors and contribution

This project is developed and maintained by Marcus Bakker (Twitter: @bakk3rm) and Ruben Bouman (Twitter: @rubenb_2). Feel free to contact, DMs are open.

We welcome contributions! Contributions can be both in code, as well as in ideas you might have for further development, usability improvements, etc.

Work of others

Some functionality within DeTT&CT was inspired by the work of others:

Example

YAML files are used for administrating scores and relevant metadata. All of which can be visualised by loading JSON layer files into the ATT&CK Navigator (some types of scores and metadata can also be written to Excel).

See below an example of mapping your data sources to ATT&CK, which gives you a rough overview of your visibility coverage:

DeTT&CT - Data quality

Installation and requirements

See our GitHub Wiki: Installation and requirements.

License: GPL-3.0

DeTT&CT's GNU General Public License v3.0