sbousseaden / macOS-ATTACK-DATASET

JSON DataSet for macOS mapped to MITRE ATT&CK Tactics.
150 stars 23 forks source link

Standardize Formatting, renamed some files #4

Open jaimeatwork opened 3 years ago

jaimeatwork commented 3 years ago

Ignoring whitespace, this mostly does cleanup of the original repository, standardizing the schema of events, adding techniques inside each of the events, and renaming Privileges Elevation to align with MITRE's Privilege Escalation. I removed whitespace in Tactic names to ease parsing, but this is mostly the original data set.

The schema now looks like this

{
    "tactic": "Collection",
    "techniques": [
    "T1000",
    "T1001"
    ],
    "documents": [
    < original content from elastic events, unchanged except for above >
    ]
}

I had thought about adding a key for references, but felt it would be better to handle that separately.

I tried my best to map events to techniques, but MITRE doesn't have full coverage of the events you documented so I used the closest appropriate ones I could.

Please let me know if you'd like to see any changes, and thanks for taking the time to review.

remotephone commented 3 years ago

This is messy because of the renamed files. A git diff will show the complete file deleted and new one created for everything in a renamed folder. 😬 sorry.

I following the instructions here and used git diff mainRepo/main..HEAD --ignore-all-space from my repo to compare branches, I think you would replace mainRepo with like forkedRepo and use the URL of my fork to do the inverse of that command, something like git diff HEAD..forkedRepo --ignore-all-space to do the cleanest diff.

jaimeatwork commented 3 years ago

lol woops, sorry the above is me, all the same still applies :)

jaimeatwork commented 3 years ago

Closes #2

I just added some tests that can be run with pytest. The first one ensures everything is json, the second one tests the schema using Schema.

jaimeatwork commented 3 years ago

howdy @sbousseaden, I understand this is a rather large pull request, please let me know if you'd like me to break this up in any way, I'd be happy to do whatever is best for you. I don't mind continuing along on my fork, but I would like to do things like contribute additional logs, tooling and documentation.