Files
sigma-rules/docs/ATT&CK-coverage.md
T
Justin Ibarra 254b4eb23f Generate ATT&CK navigator layer files and links (#1787)
* Generate attack layer files and build with package
* add update-navigator-gists command
* add workflow to update navigator gists on pushes to main
* Add coverage readme
* fix keys for links
* update navigator layer names
* purge gist files prior to update; add badge
* Update how the navigator links are displayed
* moved navigator code to dedicated and refactored to dataclasses
* convert gist links to permalink versions
* alphabetize; catch 404 for gist update
2022-03-04 08:20:44 -09:00

18 KiB

Rule coverage

ATT&CK navigator layer files are generated when a package is built with make release or python -m detection-rules. This also means they can be downloaded from all successful builds.

These files can be used to pass to a custom navigator session. For convenience, the links are generated below. You can also include multiple across tabs in a single session, though it is not advisable to upload all of them as it will likely overload your browsers resources.

Current rule coverage

The source files for these links are regenerated with every successful merge to main. These represent coverage from the state of rules in the main branch.

Full coverage: ATT&CK navigator coverage

Coverage by platform: navigator

other navigator links by rule attributes
Elastic-detection-rules-indexes-auditbeat-*
Elastic-detection-rules-indexes-filebeat-*
Elastic-detection-rules-indexes-logs-*
Elastic-detection-rules-indexes-logs-aws*
Elastic-detection-rules-indexes-logs-azure*
Elastic-detection-rules-indexes-logs-cyberarkpas
Elastic-detection-rules-indexes-logs-endpoint
Elastic-detection-rules-indexes-logs-gcp*
Elastic-detection-rules-indexes-logs-google_workspace*
Elastic-detection-rules-indexes-logs-o365*
Elastic-detection-rules-indexes-logs-okta*
Elastic-detection-rules-indexes-logs-system
Elastic-detection-rules-indexes-logs-windows
Elastic-detection-rules-indexes-metrics-*
Elastic-detection-rules-indexes-packetbeat-*
Elastic-detection-rules-indexes-traces-*
Elastic-detection-rules-indexes-winlogbeat-*
Elastic-detection-rules-tags-active-directory
Elastic-detection-rules-tags-application
Elastic-detection-rules-tags-asset-visibility
Elastic-detection-rules-tags-aws
Elastic-detection-rules-tags-azure
Elastic-detection-rules-tags-cloud
Elastic-detection-rules-tags-collection
Elastic-detection-rules-tags-command-and-control
Elastic-detection-rules-tags-communication
Elastic-detection-rules-tags-configuration-audit
Elastic-detection-rules-tags-continuous-monitoring
Elastic-detection-rules-tags-credential-access
Elastic-detection-rules-tags-cyberarkpas
Elastic-detection-rules-tags-data-protection
Elastic-detection-rules-tags-defense-evasion
Elastic-detection-rules-tags-discovery
Elastic-detection-rules-tags-elastic
Elastic-detection-rules-tags-execution
Elastic-detection-rules-tags-gcp
Elastic-detection-rules-tags-google-workspace
Elastic-detection-rules-tags-host
Elastic-detection-rules-tags-identity-and-access
Elastic-detection-rules-tags-identity
Elastic-detection-rules-tags-impact
Elastic-detection-rules-tags-initial-access
Elastic-detection-rules-tags-lateral-movement
Elastic-detection-rules-tags-linux
Elastic-detection-rules-tags-log-auditing
Elastic-detection-rules-tags-macos
Elastic-detection-rules-tags-microsoft-365
Elastic-detection-rules-tags-ml
Elastic-detection-rules-tags-monitoring
Elastic-detection-rules-tags-network-security
Elastic-detection-rules-tags-network
Elastic-detection-rules-tags-okta
Elastic-detection-rules-tags-persistence
Elastic-detection-rules-tags-post-execution
Elastic-detection-rules-tags-privilege-escalation
Elastic-detection-rules-tags-secops
Elastic-detection-rules-tags-threat-detection
Elastic-detection-rules-tags-windows
Elastic-detection-rules-tags-zoom