Skip to content

Commit 225fefa

Browse files
committed
Cleaned up readme
1 parent a22b3bd commit 225fefa

File tree

3 files changed

+6
-5575
lines changed

3 files changed

+6
-5575
lines changed

README.md

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2,36 +2,28 @@
22
[![Maintenance](https://img.shields.io/maintenance/yes/2024.svg?style=flat-square)]()
33
[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat-square)](http://makeapullrequest.com)
44
[![](https://img.shields.io/badge/2019-DEF%20CON%2027-blueviolet?style=flat-square)](https://2019.cloud-village.org/#talks?olafedoardo)
5-
[![](https://img.shields.io/badge/Official%20Azure%20Sentinel%20workbook-grey?style=flat-square&logo=microsoft-azure)](https://github.com/Azure/Azure-Sentinel/blob/master/Workbooks/SysmonThreatHunting.json)
6-
7-
[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FBlueTeamLabs%2Fsentinel-attack%2Fmaster%2Fazuredeploy.json)
85

96
Sentinel ATT&CK aims to simplify the rapid deployment of a threat hunting capability that leverages Sysmon and [MITRE ATT&CK](https://attack.mitre.org/) on Azure Sentinel.
107

118
**DISCLAIMER:** This tool requires tuning and investigative trialling to be truly effective in a production environment.
129

13-
![demo](https://github.com/BlueTeamToolkit/sentinel-attack/blob/master/docs/demo.gif)
14-
1510
### Overview
1611
Sentinel ATT&CK provides the following tools:
17-
- An [ARM template](https://github.com/BlueTeamToolkit/sentinel-attack/blob/master/azuredeploy.json) to automatically deploy Sentinel ATT&CK to your Azure environment
18-
- A [Sysmon log parser](https://github.com/BlueTeamToolkit/sentinel-attack/blob/master/parser/Sysmon-OSSEM.txt) mapped against the [OSSEM](https://github.com/Cyb3rWard0g/OSSEM) data model and compatible with the [Sysmon Modular XML configuration file](https://github.com/olafhartong/sysmon-modular/blob/master/sysmonconfig.xml)
19-
- 117 ready-to-use Kusto [detection rules](https://github.com/BlueTeamToolkit/sentinel-attack/tree/master/detections) covering 156 ATT&CK techniques
20-
- A [Sysmon threat hunting workbook](https://github.com/BlueTeamToolkit/sentinel-attack/tree/master/hunting) inspired by the [Threat Hunting App](https://splunkbase.splunk.com/app/4305/) for Splunk to help simplify threat hunts
21-
- Comprehensive guidance to help you use the materials in this repository
12+
- A [Sysmon log parser](https://github.com/netevert/sentinel-attack/blob/master/parser/Sysmon-OSSEM.txt) mapped against the [OSSEM](https://github.com/OTRF/OSSEM) data model and compatible with the [Sysmon Modular XML configuration file](https://github.com/olafhartong/sysmon-modular/blob/master/sysmonconfig.xml)
13+
- 117 ready-to-use Kusto [detection rules](https://github.com/netevert/sentinel-attack/tree/master/detections) covering 156 ATT&CK techniques
2214

2315
### Usage
24-
Head over to the [WIKI](https://github.com/BlueTeamLabs/sentinel-attack/wiki) to learn how to deploy and run Sentinel ATT&CK.
16+
Head over to the [WIKI](https://github.com/netevert/sentinel-attack/wiki) to learn how to deploy and run Sentinel ATT&CK.
2517

26-
A copy of the DEF CON 27 cloud village presentation introducing Sentinel ATT&CK can be found [here](https://2019.cloud-village.org/#talks?olafedoardo) and [here](https://github.com/BlueTeamToolkit/sentinel-attack/tree/master/docs/DEFCON_attacking_the_sentinel.pdf).
18+
A copy of the DEF CON 27 cloud village presentation introducing Sentinel ATT&CK can be found [here](https://2019.cloud-village.org/#talks?olafedoardo) and [here](https://github.com/netevert/sentinel-attack/blob/master/docs/DEFCON_attacking_the_sentinel.pdf).
2719

2820
### Contributing
29-
As this repository is constantly being updated and worked on, if you spot any problems we warmly welcome pull requests or submissions on the issue tracker.
21+
This repository is work in progress, if you spot any problems we welcome pull requests or submissions on the issue tracker.
3022

3123
### Authors and contributors
3224
Sentinel ATT&CK is built with ❤ by:
3325
- Edoardo Gerosa
34-
[![Twitter Follow](https://img.shields.io/twitter/follow/netevert.svg?style=social)](https://twitter.com/netevert)
26+
[![Twitter Follow](https://img.shields.io/twitter/follow/edoardogerosa.svg?style=social)](https://twitter.com/edoardogerosa)
3527

3628
Special thanks go to the following contributors:
3729

0 commit comments

Comments
 (0)