search

rabobank-cdc / DeTTECT

Detect Tactics, Techniques & Combat Threats
GNU General Public License v3.0
2.05k stars 333 forks source link

Guidance on how to use system's feature #81

Closed jjjjjjjj987 closed 2 years ago

jjjjjjjj987 commented 2 years ago

Greetings! Congrats on all the work with DeTTECT! It's really an awesome project.

I'm starting to use it and I'm struggling with systems types. You already provided some examples but I would like some guidance about how to best specify, for instance, firewalls and antivirus.

Currently I'm segregating by server and workstation. Should I add an EDR system type? Should I consider firewalls as a network platform type on cloud systems or add a seperate system for it?

Any help will be deeply appreciated.

rubinatorz commented 2 years ago

hi @jjjjjjjj987

Segregation on server and workstation is usually a good choice. That's because you often have different data sources on those systems. For servers you might have full Windows event logs, while for endpoints you might not have that for some reason (like the bunch of traffic it generates).

I would not choose EDR as "system type", because EDR is a data source itself. In ATT&CK you will not find EDR as data source, but it's divided into data sources you'll find within your EDR like "Process Creation" and "Process: OS API Execution" etc.

Cross-system components like firewalls, proxies and e-mail are possibly applicable to both workstations and servers, so in that case you can choose "all" as applicable-to value for your data source.

jjjjjjjj987 commented 2 years ago

Hey @rubinatorz thanks a lot! These tips were really usefull.

Have a good one!