Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update old Data Needed documents to the new structure #11

Draft
wants to merge 31 commits into
base: develop
Choose a base branch
from
Draft

Update old Data Needed documents to the new structure #11

wants to merge 31 commits into from

Conversation

yugoslavskiy
Copy link
Member

@yugoslavskiy yugoslavskiy commented Nov 23, 2020 •
edited
Loading

Please refer to the #10 for information about changes that need to be implemented, new templates, and so on.
The workflow is the following:

  1. Fetch the new_structure branch and switch to it:
$ git fetch origin new_structure
$ git checkout new_structure

  1. Comment in this PR with a task you are going to solve, so the others will not intersect with you.

  2. Modify existing file (only content, we will work out filenames later) and commit changes:

$ git add <path to file you've modified>
$ git commit -m 'update DN_XXXX'
  1. Push back your local updates to the remote new_structure branch:
$ git push origin new_structure

The list of tasks/DNs to update

NOTE: All the documents that need to be converted located in atc-data-new-structure/data.

macOS:

Windows:

Linux:

Other:

@yugoslavskiy yugoslavskiy changed the title Update old Data Needed documents to the new structure. Update old Data Needed documents to the new structure Nov 23, 2020
@yugoslavskiy yugoslavskiy mentioned this pull request Nov 23, 2020
Open
@yugoslavskiy yugoslavskiy linked an issue Nov 23, 2020 that may be closed by this pull request
Update old Data Needed docs to the new structure #10
Open
@yugoslavskiy yugoslavskiy marked this pull request as draft November 23, 2020 02:00
@yugoslavskiy
Copy link
Member Author

I'll take:

  • process/DN_0007_3_windows_sysmon_network_connection
  • process/DN_0009_5_windows_sysmon_process_terminated
  • process/DN_0012_8_windows_sysmon_CreateRemoteThread
  • process/DN_0014_10_windows_sysmon_ProcessAccess
  • process/DN_0087_5156_windows_filtering_platform_has_permitted_connection

@yugoslavskiy
Copy link
Member Author

I'll take:

  • process/DN_0085_22_windows_sysmon_DnsQuery
  • authentication_log/DN_0057_4625_account_failed_to_logon
  • authentication_log/DN_0042_675_kerberos_preauthentication_failed
  • authentication_log/DN_0004_4624_windows_account_logon
  • authentication_log/DN_0077_4769_kerberos_service_ticket_was_requested

@yugoslavskiy
Copy link
Member Author

I'll take:

  • authentication_log/DN_0078_4771_kerberos_pre_authentication_failed
  • authentication_log/DN_0082_8002_ntlm_server_blocked_audit
  • authentication_log/DN_0040_528_user_successfully_logged_on_to_a_computer
  • authentication_log/DN_0076_4768_kerberos_authentication_ticket_was_requested
  • authentication_log/DN_0079_4776_computer_attempted_to_validate_the_credentials_for_an_account
  • authentication_log/DN_0041_529_logon_failure

@yugoslavskiy
Copy link
Member Author

I'll handle:

  • mount_log/DN_0054_2102_pnp_or_power_operation_for_usb_device
  • mount_log/DN_0053_2100_pnp_or_power_operation_for_usb_device
  • mount_log/DN_0052_2003_query_to_load_usb_drivers
  • powershell_log/DN_0038_400_engine_state_is_changed_from_none_to_available
  • powershell_log/DN_0037_4103_windows_powershell_executing_pipeline
  • powershell_log/DN_0036_4104_windows_powershell_script_block
  • multiple/DN_0060_4658_handle_to_an_object_was_closed
  • multiple/DN_0058_4656_handle_to_an_object_was_requested
  • multiple/DN_0061_4660_object_was_deleted
  • multiple/DN_0062_4663_attempt_was_made_to_access_an_object

@yugoslavskiy
Copy link
Member Author

I'll take:

  • file/DN_0015_11_windows_sysmon_FileCreate
  • file/DN_0032_5145_network_share_object_was_accessed_detailed
  • file/DN_0019_15_windows_sysmon_FileCreateStreamHash
  • file/DN_0033_5140_network_share_object_was_accessed
  • file/DN_0006_2_windows_sysmon_process_changed_a_file_creation_time
  • module/DN_0011_7_windows_sysmon_image_loaded
  • named_pipe/DN_0021_18_windows_sysmon_PipeEvent
  • named_pipe/DN_0020_17_windows_sysmon_PipeEvent

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Update old Data Needed docs to the new structure
1 participant
@yugoslavskiy