• Home
  • Become a Hacker
    • Get Started
    • Hacker Mindset
    • Roadmap
    • Simple Setup – Hacker 101
    • Types of Hackers
    • Recommended Courses
  • Boot People Offline
  • Courses
    • All Hacking Courses
    • Cyber Security School
  • CTF
    • Beginners to Advanced Guide
    • Create your own CTF box
    • Field and Resources Guide
    • Platforms & Wargames
    • Tools Used for Solving CTF
    • Writeups
  • Dark Web
    • Beginners Guide
    • Darknet Markets
    • Darkweb 101 (Anonymity Guide)
    • Dark Web OSINT Tools
    • Hacking Forums
    • Latest News
    • Onion Links
  • Hacker Gadgets
  • Hacking Books
  • Tools Directory
Menu
  • Home
  • Become a Hacker
    • Get Started
    • Hacker Mindset
    • Roadmap
    • Simple Setup – Hacker 101
    • Types of Hackers
    • Recommended Courses
  • Boot People Offline
  • Courses
    • All Hacking Courses
    • Cyber Security School
  • CTF
    • Beginners to Advanced Guide
    • Create your own CTF box
    • Field and Resources Guide
    • Platforms & Wargames
    • Tools Used for Solving CTF
    • Writeups
  • Dark Web
    • Beginners Guide
    • Darknet Markets
    • Darkweb 101 (Anonymity Guide)
    • Dark Web OSINT Tools
    • Hacking Forums
    • Latest News
    • Onion Links
  • Hacker Gadgets
  • Hacking Books
  • Tools Directory
Search
Close
  • Home
  • 2020
  • April
  • 6
  • OSSEM – Open Source Security Events Metadata

OSSEM – Open Source Security Events Metadata

April 6, 2020 Comments Off on OSSEM – Open Source Security Events Metadata
OSSEM - Open Source Security Events Metadata cybersecurity ethical hacking hack android hack app hack wordpress hacker news hacking hacking tools for windows keylogger kit kitploit password brute force penetration testing pentest pentest android pentest linux pentest toolkit pentest tools spy tool kit spyware tools

The Open Source Security Events Metadata (OSSEM) is a community-led project that focuses primarily on the documentation and standardization of security event logs from diverse data sources and operating systems. Security events are documented in a dictionary format and can be used as a reference for projects like the ThreatHunter-Playbook while mapping data sources to data analytics used to validate the detection of adversarial techniques. In addition, the project provides a common information model (CIM) that can be used for data engineers during data normalization procedures to allow security analysts to query and analyze data across diverse data sources. Finally, the project also provides docu mentation about the structure and relationships identified in specific data sources to facilitate the development of data analytics.

Goals

  • Define and share a common information model in order to improve the data standardization and transformation of security event logs
  • Define and share data structures and relationships identified in security events logs
  • Provide detailed information in a dictionary format about several security event logs to the community
  • Learn more about security event logs (Windows, Linux & MacOS)
  • Have fun and think more about the data structure in your SIEM when it comes down to detection!!

Project Structure
There are four main folders:

  • Common Information Model (CIM):
    • Facilitates the normalization of data sets by providing a standard way to parse security event logs
    • It is organized by specific entities associated with event logs and defined in more details by Data Dictionaries
    • The definitions of each entity and its respective field names are mostly general descriptions that could help and expedite event logs parsing procedures.
  • Data Dictionaries:
    • Contains specific information about several security event logs organized by operating system and their respective data sets
    • Each dictionary describes a single event log and its corresponding event field names
    • The difference between the Common Information Model folder and the data dictionaries is that in the CIM the field definitions are more general whereas in a data dictionary, each field name definition is unique to the specific event log.
  • Detection Data Model:
    • Focuses on defining the required data in form of data objects and the relationships among each other needed to facilitate the creation of data analytics and validate the detection of adversary techniques
    • This is inspired by the awesome work of MITRE with their project CAR Analytics
    • The information needed for each data object is pulled from the entities defined in the Common Information Model
  • ATTACK Data Sources:
    • Focuses on the documentation of data sources suggested or associated with techniques defined in the Enterprise Matrix
    • In addition, here is where data sources will be mapped with specific data objects defined in the Detection Data Model part of the project with the main goal of creating a link between techniques, data sources and data analytics

Current Status: Alpha
The project is currently in an alpha stage, which means that the content is still changing. We welcome any feedback and suggestions to improve the project.

Projects Using OSSEM

  • HELK currently updating its pipeline configs

Resources

  • Ready to hunt? First, Show me your data!
  • What’s new in Windows 10, versions 1507 and 1511
  • Download Security Audit Events for Windows (Spreadsheet)
  • Advanced Security Audit Policy Settings
  • Monitoring Active Directory for Signs of Compromise
  • Audit Policy Recommendations
  • Use Windows Event Forwarding to help with intrusion detection
  • Minimum recommended minimum audit policy
  • Windows ITPro Docs – Threat Protection

Author

  • Roberto Rodriguez @Cyb3rWard0g

Current Committers

  • Jose Luis Rodriguez @Cyb3rPandaH
  • Nate Guagenti @neu5ron
  • Fred Frey @FryGuy2600
  • Ricardo Dias @hxnoyd
Download OSSEM

Post navigation

gitleaks v4.1.1 releases: Searches full repo history for secrets and keys
Rank Math SEO Plugin vulnerabilities put over 200,000 WordPress sites at risks

Related Articles

Emba - An Analyzer For Linux-based Firmware Of Embedded Devices

Emba – An Analyzer For Linux-based Firmware Of Embedded Devices

- Hack Tools
January 27, 2021
dronesploit v1.1 releases: Drone pentesting framework console

dronesploit v1.1 releases: Drone pentesting framework console

- Hack Tools
January 27, 2021
Batea - AI-based, Context-Driven Network Device Ranking

Batea – AI-based, Context-Driven Network Device Ranking

- Hack Tools
January 27, 2021
hacker gadgets
hacker phone covers

Recent Posts

Emba - An Analyzer For Linux-based Firmware Of Embedded Devices

Emba – An Analyzer For Linux-based Firmware Of Embedded Devices

January 27, 2021
dronesploit v1.1 releases: Drone pentesting framework console

dronesploit v1.1 releases: Drone pentesting framework console

January 27, 2021
CVE-2021-3156: Sudo Heap-Based Buffer Overflow Vulnerability Alert

CVE-2021-3156: Sudo Heap-Based Buffer Overflow Vulnerability Alert

January 27, 2021
Batea - AI-based, Context-Driven Network Device Ranking

Batea – AI-based, Context-Driven Network Device Ranking

January 27, 2021
A picture of DutchMasters had a popular vendor shop accessible only through Tor

Netherlands Police Make Six Arrests in Dutchmasters Case

January 27, 2021
SharpSphere: Attacking vSphere Infrastructure

SharpSphere: Attacking vSphere Infrastructure

January 26, 2021

Social Media Hacking

SocialPath – Track users across Social Media Platforms

SocialPath – Track users across Social Media Platforms

- Social Media Hacking
October 16, 2019October 16, 2019

SocialPath is a django application for gathering social media intelligence on specific username. It checks for Twitter, Instagram, Facebook, Reddit...

SocialScan – Check Email Address and Username Availability on Online Platforms

SocialScan – Check Email Address and Username Availability on Online Platforms

June 17, 2019
Shellphish – Phishing Tool For 18 Social Media Apps

Shellphish – Phishing Tool For 18 Social Media Apps

June 10, 2019July 27, 2019
WhatsApp Hacking using QRLJacking

WhatsApp Hacking using QRLJacking

May 2, 2019May 19, 2019
How to Hack any Facebook Account with Z-Shadow

How to Hack any Facebook Account with Z-Shadow

April 26, 2019June 29, 2020
hacker buffs
ABOUT US

Haxf4rall is a collective, a good starting point and provides a variety of quality material for cyber security professionals.

Our primary focus revolves around the latest tools released in the Infosec community and provide a platform for developers to showcase their skillset and current projects.

COMPANY
  • Contact Us
  • Disclaimer
  • Hacker Gadgets
  • Privacy Policy
  • Sitemap
  • Submit your Tool
Menu
  • Contact Us
  • Disclaimer
  • Hacker Gadgets
  • Privacy Policy
  • Sitemap
  • Submit your Tool
Live Chat
RESOURCES
  • Attack Process
  • Become a Hacker
  • Career Pathways
  • Dark Web
  • Hacking Books
  • Practice Your Skills
  • Recommended Courses
  • Simple Setup – Hacker 101
Menu
  • Attack Process
  • Become a Hacker
  • Career Pathways
  • Dark Web
  • Hacking Books
  • Practice Your Skills
  • Recommended Courses
  • Simple Setup – Hacker 101
Get Started
TOOLBOX
  • Anonymity
  • Bruteforce
  • DoS – Denial of Service
  • Information Gathering
  • Phishing
  • SQL Injection
  • Vulnerability Scanners
  • Wifi Hacking
Menu
  • Anonymity
  • Bruteforce
  • DoS – Denial of Service
  • Information Gathering
  • Phishing
  • SQL Injection
  • Vulnerability Scanners
  • Wifi Hacking
Tools Directory

2014 – 2020 | Haxf4rall.com               Stay Connected:

Facebook
Twitter
Google-plus
Wordpress
Please wait...

Join Our Community

Subscribe now and get your free HACKERS HANDBOOK

Don't Worry ! You will not be spammed
SIGN UP FOR NEWSLETTER NOW