627 lines
16 KiB
YAML
627 lines
16 KiB
YAML
%YAML 1.2
|
|
---
|
|
version: 1.0
|
|
file_type: data-source-administration
|
|
name: endpoints-example
|
|
platform: windows
|
|
data_sources:
|
|
# A data source is treated as not available when all dimensions of the data quality have a score of 0.
|
|
# If desired you are free to add any key-value pairs.
|
|
- data_source_name: Process monitoring
|
|
date_registered: 2019-03-01
|
|
date_connected: 2017-01-01
|
|
products: [Windows event log]
|
|
available_for_data_analytics: True
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 5
|
|
data_field_completeness: 5
|
|
timeliness: 5
|
|
consistency: 5
|
|
retention: 5
|
|
- data_source_name: File monitoring
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Process command-line parameters
|
|
date_registered: 2019-03-01
|
|
date_connected: 2017-01-01
|
|
products: [Windows event log]
|
|
available_for_data_analytics: True
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: API monitoring
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Process use of network
|
|
date_registered: 2019-07-25
|
|
date_connected: 2019-07-25
|
|
products: [Sysmon]
|
|
available_for_data_analytics: True
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 5
|
|
data_field_completeness: 5
|
|
timeliness: 5
|
|
consistency: 5
|
|
retention: 5
|
|
- data_source_name: Windows Registry
|
|
date_registered: 2019-03-01
|
|
date_connected: 2017-02-01
|
|
products: [Windows event log]
|
|
available_for_data_analytics: True
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 5
|
|
data_field_completeness: 5
|
|
timeliness: 5
|
|
consistency: 5
|
|
retention: 5
|
|
- data_source_name: Packet capture
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Authentication logs
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Netflow/Enclave netflow
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Windows event logs
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Binary file metadata
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Network protocol analysis
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: DLL monitoring
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Loaded DLLs
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: System calls
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Malware reverse engineering
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: SSL/TLS inspection
|
|
date_registered: 2019-01-10
|
|
date_connected: 2000-01-01
|
|
products: [Proxy Product]
|
|
available_for_data_analytics: True
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 5
|
|
data_field_completeness: 5
|
|
timeliness: 5
|
|
consistency: 5
|
|
retention: 5
|
|
- data_source_name: Anti-virus
|
|
date_registered: 2019-01-10
|
|
date_connected: 2000-01-01
|
|
products: [AV Product]
|
|
available_for_data_analytics: True
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 4
|
|
data_field_completeness: 2
|
|
timeliness: 3
|
|
consistency: 5
|
|
retention: 5
|
|
- data_source_name: Network intrusion detection system
|
|
date_registered: 2019-01-10
|
|
date_connected: 2016-01-01
|
|
products: [NIDS]
|
|
available_for_data_analytics: True
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 4
|
|
data_field_completeness: 3
|
|
timeliness: 3
|
|
consistency: 4
|
|
retention: 4
|
|
- data_source_name: Data loss prevention
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Application logs
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Email gateway
|
|
date_registered: 2019-01-10
|
|
date_connected: 2000-01-01
|
|
products: [Email Gateway Product]
|
|
available_for_data_analytics: True
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 4
|
|
data_field_completeness: 3
|
|
timeliness: 3
|
|
consistency: 5
|
|
retention: 3
|
|
- data_source_name: Network device logs
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Web proxy
|
|
date_registered: 2019-01-10
|
|
date_connected: 2000-01-01
|
|
products: [Proxy Product]
|
|
available_for_data_analytics: True
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 5
|
|
data_field_completeness: 5
|
|
timeliness: 5
|
|
consistency: 5
|
|
retention: 5
|
|
- data_source_name: Windows Error Reporting
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Kernel drivers
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: User interface
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Host network interface
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Third-party application logs
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Services
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Web logs
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Detonation chamber
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Mail server
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Environment variable
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: MBR
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: BIOS
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Web application firewall logs
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Asset management
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: DHCP
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: True
|
|
comment: 'At the time of writing: unknown data source within ATT&CK'
|
|
data_quality:
|
|
device_completeness: 5
|
|
data_field_completeness: 5
|
|
timeliness: 5
|
|
consistency: 5
|
|
retention: 5
|
|
- data_source_name: DNS records
|
|
date_registered: 2019-03-01
|
|
date_connected: 2017-04-01
|
|
products: [Windows DNS server]
|
|
available_for_data_analytics: True
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 5
|
|
data_field_completeness: 5
|
|
timeliness: 5
|
|
consistency: 5
|
|
retention: 5
|
|
- data_source_name: Browser extensions
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Access tokens
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Digital certificate logs
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Disk forensics
|
|
date_registered: 2019-01-10
|
|
date_connected: 2019-01-01
|
|
products: [Manual, Commercial tool]
|
|
available_for_data_analytics: True
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 5
|
|
data_field_completeness: 5
|
|
timeliness: 1
|
|
consistency: 5
|
|
retention: 0
|
|
- data_source_name: Component firmware
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: WMI Objects
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: VBR
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Named Pipes
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: Sensor health and status
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: EFI
|
|
date_registered:
|
|
date_connected:
|
|
products: [None]
|
|
available_for_data_analytics: False
|
|
comment: ''
|
|
data_quality:
|
|
device_completeness: 0
|
|
data_field_completeness: 0
|
|
timeliness: 0
|
|
consistency: 0
|
|
retention: 0
|
|
- data_source_name: PowerShell logs
|
|
date_registered: 2019-03-01
|
|
date_connected: 2018-05-01
|
|
products: [Windows event log]
|
|
available_for_data_analytics: True
|
|
comment: 'Script block logging is enabled'
|
|
data_quality:
|
|
device_completeness: 5
|
|
data_field_completeness: 5
|
|
timeliness: 5
|
|
consistency: 5
|
|
retention: 4
|
|
exceptions:
|
|
# Adding a technique ID below will result in removing that technique in the heat map (meaning not enough data source or quality is available for proper detection).
|
|
# Please note that the below is just an example, many more can exists.
|
|
# Filling in the key-value pair name is optional.
|
|
- technique_id: T1130
|
|
name: Install Root Certificate |