DeTTECT Tutorial about dettect

[palevelmode]

Hi We can close this now. Thanks for your and your team's support. I got a positive outcome when I use this tool to visualize our current security posture. Our management was pleased :)

A little bit off topic. I hope you can share a high quality of the DeTTECT logo. If it is OK with your team I like to have it as banner here in our SOC and as a hoodie also.

Kudos to you all. Long live #Blue #Azul

[marcusbakker]

@palevelmode Ruben and I wrote a blog on DeTT&CT that can be found here: DeTT&CT: Mapping your Blue Team to MITRE ATT&CK™. In addition, you can find slides from a presentation we gave here: https://github.com/rabobank-cdc/Presentations/blob/master/20190510_DeTT%26CT%20-%20European%20MITRE%20ATTACK%20Group.pdf

I hope the blog and slides help. Is there anything in particular you can't follow? Happy to explain.

[palevelmode]

Thank Sir Marcus, I will walk through the link you have shared. And will get back once I have a question. Actually I have done this Mitre mapping the same from the threat hunting guide of cyberwardog.

[palevelmode]

Thank you. I am happy. I have the grasp how to use this tool now. Can I ask how can I check my current data sources using the statistics. below. Can change the path or file name? Seems like this is a default.

python dettect.py generic --statistics

[marcusbakker]

When using the comment python dettect.py generic --statistics it will calculate statistics based on the information ATT&CK has on the data sources listed within ATT&CK techniques. So, it gives you an indication on which data sources are of the most value.

More interesting for you may be to use your data source administration file to draft a rough overview of your visibility coverage and load the JSON layer file into the ATT&CK Navigator: python dettect.py ds -f sample-data/data-sources-endpoints.yaml -l

[marcusbakker]

Good to hear that you had a positive outcome in using DeTT&CT! Thanks for letting us know. Always very nice to hear when others also find it useful and have success in using it :-D

Awesome! I've uploaded a high res logo on my personal GitHub: https://github.com/marcusbakker/Miscellaneous/raw/master/DeTT%26CT-logo.png

[palevelmode]

Hi Sir, Thank you again.

Our long term would be the mapping of SOC detection capabilities via "detection" heat map.

[marcusbakker]

You're welcome