Ricardo Dias

Technique data sources

1

Hi! First of all, kudos for the initiative, and reminding us that ATT&CK is not EDR only. Many (if not all) of the techniques you have mapped don't have the...

Currently, there is no how-to on how to operate the ossem_converter.py script, that recreates OSSEM MD pages from the YAML source.

Detection data model and required data fields

1

The current detection data model (DDM) does not take into consideration mandatory data fields, for example: I want to develop a detection analytic on "win registry key modification", and I...

Support NIDS and WAF via new 'network traffic content' relationship

2

Hello. With the new DS structure NIDS and WAF are no longer available. A new relationship could be created in order to improve the mapping with alert related events: *...

pehash function integration in pe module

7

This is an enhancement request. Is it possible to compute pehash via pe module in the same way imphash is? Viper's implementation seems pretty solid and is already used by...

Currently, the HTTP entity inherits only from user-agent, but not URL. Hence, the HTTP entity has no url attributes (i.e. url_path). Having the url entity extending into http would result...

Hi. AnalysisResult() should be able to ingest tags, from a matches tags list, in order to populate the report tags accordingly. Thanks in advance. Ricardo