otrf / ossem-cdm Goto Github PK
View Code? Open in Web Editor NEWOSSEM Common Data Model
License: MIT License
OSSEM Common Data Model
License: MIT License
Alternative names
for now remove it from Networking table and Event entity.
OSSEM-CDM/schemas/entities/dns.yml
Line 106 in dacbc88
The text and example for "hex" is for the regular and vice-versa.
Hi Team,
Why some fields are missing in the yml files?
For example, consider "destination_nat" entity. Here you can find multiple fields:
https://ossemproject.com/cdm/entities/destination_nat.html
However, in the yml file, I just find one field (i.e., original_value):
https://github.com/OTRF/OSSEM-CDM/blob/14c48b27c107abe5a76fbd1bcb16e8bf78882172/schemas/entities/destination_nat.yml
Should not they match together?
We want to be consistent with our recent collaboration efforts and it makes sense to migrate to PasacalCase.
Title of the document does not align with the name of the file.
We want to parse URLs passed as part of the event to get to it
OSSEM-CDM/schemas/entities/process.yml
Line 35 in dacbc88
The current process entity includes the field 'process_file_directory" which is documented to be the current directory, and the image path. Those are not the same. I suggest adding a field called process_current_directory.
OSSEM-CDM/schemas/entities/registry.yml
Line 23 in dacbc88
Both Sysmon event 14 and Microsoft Defender 365 "RegistryKeyRenamed" events reference both the original and the new keys, and hence two key fields are needed "key" and "key_modified"
As a reminder, in one of our recent discussions we decided to remove the suffix original from this and similar headers. This is challenging for User Agent as it is defined as an entity and "original" is essentially the field name. Maybe having UA as an entity rather than an HTTP attribute is the culprit?
ProcessMD5
ProcessHashMD5
ProcesFileHashMD5
Currently, the HTTP entity inherits only from user-agent, but not URL. Hence, the HTTP entity has no url attributes (i.e. url_path).
Having the url entity extending into http would result in a more complete, easier to map (i.e. proxy log source), http entity.
OSSEM-CDM/schemas/entities/registry.yml
Line 48 in dacbc88
The original registry fields are appended with "_modified" to reflect the value before change. However the fields "registry_value_name_modified" and "registry_value" do not keep this convention.
We need documentation to define where we use Source
, Destination
or Target
.
OSSEM-CDM/schemas/entities/file.yml
Line 103 in dacbc88
previous_name includes path, while name does not. I suggest adding previous_path.
How I can put together the original request
OSSEM-CDM/schemas/entities/http.yml
Line 23 in dacbc88
As a reminder, in one of our recent discussions we decided to remove the suffix original from this and similar headers.
It would be good to provide an ID attribute to the vendor in case an organization.
Event_resource should need to be split and process Resource as its own thing.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.