- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
03-12-2024 05:27 PM
I am using the DeTTeCT approach to assessing our coverage against ATT&CK: GitHub - rabobank-cdc/DeTTECT: Detect Tactics, Techniques & Combat Threats. In this approach, you need to start with a set of yaml files that have your datasources and detections.
I have recently completed a set of PA plugins for the dettectinator project here GitHub - themyops/pa_dettectinator: Dettectinator - The Python library to your DeTT&CT YAML files.. This is a fork of the original dettectinator project here GitHub - siriussecurity/dettectinator: Dettectinator - The Python library to your DeTT&CT YAML files... which has two specific Cortex XDR modules added
1. The datasources module goes through the datalake event logs and itemizes all the detected EventIDs, maps them to the OSSEM framework and gives you an inital DeTTeCT yaml file.
2. The techniques module goes through the datalake and gets the techniques from the alerts tables. There are some optional parameters that will allow for a selection of fields as well as a start date.
This approach can help to get the initial yaml files from what is already available in the datalake.
03-18-2024 12:56 AM
Dear @Hinne.Hettema ,
Hope you are doing well and thank you for reaching out to the Live Community. I would like to thank you for your detail explanation on how to get yaml files. Your knowledge sharing is greatly appreciated. Thank you.
03-18-2024 02:58 PM
You'll need the API keys to a functioning Cortex XDR (appID and secret), as well as the workspace URL. Have a look in the configuration file example in the repo: https://github.com/themyops/pa_dettectinator/blob/main/examples/pa_datasource_config_example.json. Then run the dettectinator with the config file and it will generate the yaml file. These can be further edited with the DeTTeCT editor.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!