MITRE DeTTECT - Data Source Visibility and Mapping

Автор: Tellaro

Загружено: 2021-02-22

Просмотров: 17126

Описание: This video shows how to use MITRE DeTTECT (DeTT&CT) to map data source coverage to MITRE ATT&CK. DeTTECT is an open-source project that makes data source mapping and coverage assessment easy. In this video you will learn how to track the data sources your organization currently collects as well as build potential future data sources. The results will be a MITRE Navigator mapping that can be used to communicate the need to add additional data sources.

1:38 MITRE DeTTECT - Tool for mapping data sources
3:52 Installing MITRE DeTTECT
6:45 Running Web Editor
7:13 Demo - Setting current data source coverage
10:42 Convert YAML file to JSON for consumption in MITRE Navigator
11:25 Load visibility map into MITRE Navigator
12:04 Create more demo data for comparison
14:14 Compare various data source coverage against each other

dettect.py commands ran in the video:
Run web editor
python dettect.py editor &

Convert YAML to JSON
python dettect.py ds -fd /mnt/c/Users/JustinHenderson/Downloads/data-sources-new.yaml -l

List coverage by data source
python dettect.py generic -ds

Links:

MITRE Navigator
https://mitre-attack.github.io/attack...

MITRE ATT&CK Enterprise Matrix
https://attack.mitre.org/matrices/ent...

MITRE DeTT&CT (Local instance)
http://localhost:8080/dettect-editor/

MITRE DeTT&CT (Remote instance)
https://rabobank-cdc.github.io/dettec...

Не удается загрузить Youtube-плеер. Проверьте блокировку Youtube в вашей сети.
Повторяем попытку...

MITRE DeTTECT - Data Source Visibility and Mapping

Доступные форматы для скачивания:

Скачать видео

Информация по загрузке:

Скачать аудио

Похожие видео

MITRE Practical Use Cases

MITRE Practical Use Cases

Workshop: MITRE ATT&CK Fundamentals

Workshop: MITRE ATT&CK Fundamentals

Картирование APT TTP с помощью MITRE ATT&CK Navigator

Картирование APT TTP с помощью MITRE ATT&CK Navigator

1 - Zero Trust

Detect, Deny, and Disrupt with MITRE D3FEND

Detect, Deny, and Disrupt with MITRE D3FEND

Introduction To The MITRE ATT&CK Framework

Introduction To The MITRE ATT&CK Framework

ReflexSOAR - Automatic alert handling with Event Rules

ReflexSOAR - Automatic alert handling with Event Rules

The Detection Engineering Process w/ Hayden Covington #livestream

The Detection Engineering Process w/ Hayden Covington #livestream

Putting MITRE ATT&CK™ into Action with What You Have, Where You Are presented by Katie Nickels

Putting MITRE ATT&CK™ into Action with What You Have, Where You Are presented by Katie Nickels

Using MITRE's ATT&CK Navigator for Gap Analysis

Using MITRE's ATT&CK Navigator for Gap Analysis

Взломать за один промпт. Как OpenClaw открывает простор для киберпреступников

Взломать за один промпт. Как OpenClaw открывает простор для киберпреступников

Windows Event Forwarding at Scale

Windows Event Forwarding at Scale

Live Stream #1 - Rip the bandaid off

Live Stream #1 - Rip the bandaid off

David Branscome - Using DeTTECT and the MITRE ATT&CK Framework to Assess Your Security Posture

David Branscome - Using DeTTECT and the MITRE ATT&CK Framework to Assess Your Security Posture

How To Use The Elastic Stack as a SIEM - John Hubbard

How To Use The Elastic Stack as a SIEM - John Hubbard

Docker 101 - The Quick Basics

Docker 101 - The Quick Basics

DeTT&CT: Mapping Your Blue Team To MITRE ATT&CK - Ruben Bouman and Marcus Bakker

DeTT&CT: Mapping Your Blue Team To MITRE ATT&CK - Ruben Bouman and Marcus Bakker

Security Lab Hardware Recommendations in 2021

Security Lab Hardware Recommendations in 2021

Using Zeek/Bro To Discover Network TTPs of MITRE ATT&CK™ Part 1

Using Zeek/Bro To Discover Network TTPs of MITRE ATT&CK™ Part 1

Implementing MITRE ATT&CK into a SOC

Implementing MITRE ATT&CK into a SOC