Skip to content

Update old Data Needed documents to the new structure#11

Draft
yugoslavskiy wants to merge 31 commits intodevelopfrom
new_structure
Draft

Update old Data Needed documents to the new structure#11
yugoslavskiy wants to merge 31 commits intodevelopfrom
new_structure

Conversation

@yugoslavskiy
Copy link
Member

@yugoslavskiy yugoslavskiy commented Nov 23, 2020 •
edited
Loading

Please refer to the #10 for information about changes that need to be implemented, new templates, and so on.
The workflow is the following:

  1. Fetch the new_structure branch and switch to it:
$ git fetch origin new_structure
$ git checkout new_structure

  1. Comment in this PR with a task you are going to solve, so the others will not intersect with you.

  2. Modify existing file (only content, we will work out filenames later) and commit changes:

$ git add <path to file you've modified>
$ git commit -m 'update DN_XXXX'
  1. Push back your local updates to the remote new_structure branch:
$ git push origin new_structure

The list of tasks/DNs to update

NOTE: All the documents that need to be converted located in atc-data-new-structure/data.

macOS:

Windows:

Linux:

Other:

@yugoslavskiy yugoslavskiy changed the title Update old Data Needed documents to the new structure. Update old Data Needed documents to the new structure Nov 23, 2020
@yugoslavskiy yugoslavskiy mentioned this pull request Nov 23, 2020
Open
@yugoslavskiy yugoslavskiy linked an issue Nov 23, 2020 that may be closed by this pull request
Update old Data Needed docs to the new structure #10
Open
@yugoslavskiy yugoslavskiy marked this pull request as draft November 23, 2020 02:00
@yugoslavskiy
Copy link
Member Author

yugoslavskiy commented Dec 2, 2020

I'll take:

  • process/DN_0007_3_windows_sysmon_network_connection
  • process/DN_0009_5_windows_sysmon_process_terminated
  • process/DN_0012_8_windows_sysmon_CreateRemoteThread
  • process/DN_0014_10_windows_sysmon_ProcessAccess
  • process/DN_0087_5156_windows_filtering_platform_has_permitted_connection

@yugoslavskiy
Copy link
Member Author

yugoslavskiy commented Dec 21, 2020

I'll take:

  • process/DN_0085_22_windows_sysmon_DnsQuery
  • authentication_log/DN_0057_4625_account_failed_to_logon
  • authentication_log/DN_0042_675_kerberos_preauthentication_failed
  • authentication_log/DN_0004_4624_windows_account_logon
  • authentication_log/DN_0077_4769_kerberos_service_ticket_was_requested

@yugoslavskiy
Copy link
Member Author

yugoslavskiy commented Jan 13, 2021

I'll take:

  • authentication_log/DN_0078_4771_kerberos_pre_authentication_failed
  • authentication_log/DN_0082_8002_ntlm_server_blocked_audit
  • authentication_log/DN_0040_528_user_successfully_logged_on_to_a_computer
  • authentication_log/DN_0076_4768_kerberos_authentication_ticket_was_requested
  • authentication_log/DN_0079_4776_computer_attempted_to_validate_the_credentials_for_an_account
  • authentication_log/DN_0041_529_logon_failure

@yugoslavskiy
Copy link
Member Author

yugoslavskiy commented Jan 31, 2021

I'll handle:

  • mount_log/DN_0054_2102_pnp_or_power_operation_for_usb_device
  • mount_log/DN_0053_2100_pnp_or_power_operation_for_usb_device
  • mount_log/DN_0052_2003_query_to_load_usb_drivers
  • powershell_log/DN_0038_400_engine_state_is_changed_from_none_to_available
  • powershell_log/DN_0037_4103_windows_powershell_executing_pipeline
  • powershell_log/DN_0036_4104_windows_powershell_script_block
  • multiple/DN_0060_4658_handle_to_an_object_was_closed
  • multiple/DN_0058_4656_handle_to_an_object_was_requested
  • multiple/DN_0061_4660_object_was_deleted
  • multiple/DN_0062_4663_attempt_was_made_to_access_an_object

@yugoslavskiy
Copy link
Member Author

yugoslavskiy commented Feb 1, 2021

I'll take:

  • file/DN_0015_11_windows_sysmon_FileCreate
  • file/DN_0032_5145_network_share_object_was_accessed_detailed
  • file/DN_0019_15_windows_sysmon_FileCreateStreamHash
  • file/DN_0033_5140_network_share_object_was_accessed
  • file/DN_0006_2_windows_sysmon_process_changed_a_file_creation_time
  • module/DN_0011_7_windows_sysmon_image_loaded
  • named_pipe/DN_0021_18_windows_sysmon_PipeEvent
  • named_pipe/DN_0020_17_windows_sysmon_PipeEvent

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Update old Data Needed docs to the new structure

1 participant

@yugoslavskiy