Sysmon data dictionaries compliant with entities

OTRF / OSSEM

Open Source Security Events Metadata (OSSEM)

MIT License

1.24k stars 215 forks source link

Sysmon data dictionaries compliant with entities #105

Closed nicolasreich closed 3 years ago

nicolasreich commented 3 years ago

Sysmon data dictionaries aren't compliant with the latest version of entities. I can start working on a compliant version right now, but @Cyb3rWard0g mentioned in other issues that you were reviewed all Windows events, so I want to make sure you haven't something ongoing on your side, to not duplicate work.

Cyb3rWard0g commented 3 years ago

Thank you @nicolasreich ! I am looking into it at the moment. I was also very busy with a few things. I will share the commit soon :)

Cyb3rWard0g commented 3 years ago

https://github.com/OTRF/OSSEM-DD/commit/c2b64f69e0f98a3bc9f8ff28ceccf0ac1e826ec4