Using Cortex with DeTTeCT and dettectinator

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Using Cortex with DeTTeCT and dettectinator

L0 Member

I am using the DeTTeCT approach to assessing our coverage against ATT&CK: GitHub - rabobank-cdc/DeTTECT: Detect Tactics, Techniques & Combat Threats. In this approach, you need to start with a set of yaml files that have your datasources and detections.

 

I have recently completed a set of PA plugins for the dettectinator project here GitHub - themyops/pa_dettectinator: Dettectinator - The Python library to your DeTT&CT YAML files.. This is a fork of the original dettectinator project here GitHub - siriussecurity/dettectinator: Dettectinator - The Python library to your DeTT&CT YAML files... which has two specific Cortex XDR modules added

 

1. The datasources module goes through the datalake event logs and itemizes all the detected EventIDs, maps them to the OSSEM framework and gives you an inital DeTTeCT yaml file.

2. The techniques module goes through the datalake and gets the techniques from the alerts tables. There are some optional parameters that will allow for a selection of fields as well as a start date.

 

This approach can help to get the initial yaml files from what is already available in the datalake.

2 REPLIES 2

L3 Networker

Dear @Hinne.Hettema , 

 

Hope you are doing well and thank you for reaching out to the Live Community. I would like to thank you for your detail explanation on how to get yaml files. Your knowledge sharing is greatly appreciated. Thank you. 

L0 Member

You'll need the API keys to a functioning Cortex XDR (appID and secret), as well as the workspace URL. Have a look in the configuration file example in the repo: https://github.com/themyops/pa_dettectinator/blob/main/examples/pa_datasource_config_example.json. Then run the dettectinator with the config file and it will generate the yaml file. These can be further edited with the DeTTeCT editor.

  • 929 Views
  • 2 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!