This repository has been archived by the owner on Dec 30, 2023. It is now read-only.

Commits

Commits on Aug 2, 2022

Commits on Jun 13, 2022

migrate to Defender_TA_nxtp, add missing eventIDs and create new lookup tables for attacksurface, categories and origins
n0mer1
committed

Commits on Aug 28, 2021

linted and reformated files
n0mer1
committed
Added field product_version in Malware_Operations dataset

nbthi1
authored and
n0mer1
committed

Commits on Apr 11, 2021

update navigation
n0mer1
committed

Commits on Apr 9, 2021

update pipeline to use template
n0mer1
committed

Commits on Feb 4, 2021

Better integration for documentation and flattened structure
n0mer1
committed

Commits on Dec 21, 2020

improved lookup table for signatures and added exploit protection events from Microsoft-Windows-Security-Mitigations/KernelMode with sourcetype renaming to Defender
n0mer1
committed

Commits on Dec 19, 2020

Merge pull request #1 from pentekl/master
n0mer1
authored

Commits on Dec 16, 2020

update category for 2020 and 2021 event ids to update
n0mer1
committed

Commits on Nov 16, 2020

Eventid 1151 description updated
pentekl
authored

Commits on Nov 14, 2020

set default permission as least minimum default being readable just for admin, can_delete, power, user
n0mer1
committed

Commits on Oct 12, 2020

Add Subsystem to signature 1160
Christian Hartl
committed

Commits on Oct 5, 2020

Merged PR 252: Simplify logic in regex and field for file_path & file_name + fix source stanza for general usage

Christian Hartl
authored and
k0dit
committed
readme update and source stanza fix
n0mer1
committed

Commits on Sep 29, 2020

Simplify logic in regex and field for file_path and file_name
Christian Hartl
committed

Commits on Aug 25, 2020

Merged PR 157: First field extractions according to the CIM event types malware and IDS alerts with, look-up tables from research in MS documentation and documentation.
n0mer1
committed

Commits on Jul 28, 2020