Using Cortex with DeTTeCT and dettectinator

[Hinne.Hettema]

I am using the DeTTeCT approach to assessing our coverage against ATT&CK: GitHub - rabobank-cdc/DeTTECT: Detect Tactics, Techniques & Combat Threats. In this approach, you need to start with a set of yaml files that have your datasources and detections.

I have recently completed a set of PA plugins for the dettectinator project here GitHub - themyops/pa_dettectinator: Dettectinator - The Python library to your DeTT&CT YAML files.. This is a fork of the original dettectinator project here GitHub - siriussecurity/dettectinator: Dettectinator - The Python library to your DeTT&CT YAML files... which has two specific Cortex XDR modules added

1. The datasources module goes through the datalake event logs and itemizes all the detected EventIDs, maps them to the OSSEM framework and gives you an inital DeTTeCT yaml file.

2. The techniques module goes through the datalake and gets the techniques from the alerts tables. There are some optional parameters that will allow for a selection of fields as well as a start date.

This approach can help to get the initial yaml files from what is already available in the datalake.

[abdrahman]

Dear @Hinne.Hettema , 

Hope you are doing well and thank you for reaching out to the Live Community. I would like to thank you for your detail explanation on how to get yaml files. Your knowledge sharing is greatly appreciated. Thank you. 

[Hinne.Hettema]

You'll need the API keys to a functioning Cortex XDR (appID and secret), as well as the workspace URL. Have a look in the configuration file example in the repo: https://github.com/themyops/pa_dettectinator/blob/main/examples/pa_datasource_config_example.json. Then run the dettectinator with the config file and it will generate the yaml file. These can be further edited with the DeTTeCT editor.