Merge pull request #1066 from ocsf/d3fend

Support for MITRE D3FEND, Remediation Category and Classes
ocsf · May 15, 2024 · 0949e27 · 0949e27
2 parents 32c164d + 6ffb29c
commit 0949e27
Show file tree

Hide file tree

Showing 14 changed files with 224 additions and 21 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -41,10 +41,13 @@ Thankyou! -->
 
 ### Added
 * #### Categories
+    1. Added `Remediation` category. #1066
 * #### Event Classes
     1. Added `Event Log Activity` event class. #1014
+    2. Added `Remediation Activity` `File Remediation Activity` `Process Remediation Activity` `Network Remediation Activity` event classes. #1066
 * #### Profiles
 * #### Objects
+    1. Added `d3fend` `d3f_tactic` `d3f_technique` MITRE objects. #1066
 * #### Platform Extensions
 
 ### Improved
@@ -72,6 +75,7 @@ Thankyou! -->
         * Updated the description of `metadata.profiles` to clarify the correct way to reference a profile in that list.
     3. Added a `gitignore` file. #1071
     4. New Extension registration for Cisco #1074
+    5. Cleaned up MITRE trademarks and registrations for captions and descriptions.
 
 ## [v1.2.0] - April 23rd, 2024
 

diff --git a/categories.json b/categories.json
@@ -32,6 +32,11 @@
       "caption": "Application Activity",
       "description": "Application Activity events report detailed information about the behavior of applications and services.",
       "uid": 6
+    },
+    "remediation": {
+      "caption": "Remediation",
+      "description": "Remediation events report the results of remediation commands targeting files, processes, and other objects.",
+      "uid": 7
     }
   }
 }
diff --git a/dictionary.json b/dictionary.json
@@ -1078,6 +1078,12 @@
       "description": "The number of times that events in the same logical group occurred during the event <strong>Start Time</strong> to <strong>End Time</strong> period.",
       "type": "integer_t"
     },
+    "countermeasures": {
+      "caption": "Countermeasures",
+      "description": "The MITRE DEFEND™ Matrix Countermeasures associated with a remediation.",
+      "type": "d3fend",
+      "is_array": true
+    },
     "country": {
       "observable": 14,
       "caption": "Country",
@@ -1188,6 +1194,16 @@
         "since": "1.1.0"
       }
     },
+    "d3f_tactic": {
+      "caption": "MITRE DEFEND™ Tactic",
+      "description": "The D3FEND Tactic object describes the defensive tactic name associated with a countermeasure, as defined by <a target='_blank' href='https://d3fend.mitre.org'>D3FEND<sup>TM</sup> Matrix</a>.",
+      "type": "d3f_tactic"
+    },
+    "d3f_technique": {
+      "caption": "MITRE DEFEND™ Technique",
+      "description": "The D3FEND Technique object describes the defensive technique ID and/or name associated with a countermeasure, as defined by <a target='_blank' href='https://d3fend.mitre.org'>D3FEND<sup>TM</sup> Matrix</a>.",
+      "type": "d3f_technique"
+    },
     "data": {
       "caption": "Data",
       "description": "The additional data that is associated with the event or object. See specific usage.",
@@ -3905,7 +3921,7 @@
     },
     "sub_technique": {
       "caption": "Sub Technique",
-      "description": "The Sub Technique object describes the sub technique ID and/or name associated to an attack, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK Matrix<sup>TM</sup></a>.",
+      "description": "The Sub Technique object describes the sub technique ID and/or name associated to an attack, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK® Matrix</a>.",
       "type": "sub_technique"
     },
     "subdomain": {
@@ -3960,12 +3976,12 @@
     },
     "tactic": {
       "caption": "Tactic",
-      "description": "The Tactic object describes the tactic ID and/or name that is associated to an attack, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK Matrix<sup>TM</sup></a>.",
+      "description": "The Tactic object describes the tactic ID and/or name that is associated to an attack, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK® Matrix</a>.",
       "type": "tactic"
     },
     "tactics": {
       "caption": "Tactics",
-      "description": "The Tactic object describes the tactic ID and/or tactic name that are associated with the attack technique, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK Matrix<sup>TM</sup></a>.",
+      "description": "The Tactic object describes the tactic ID and/or tactic name that are associated with the attack technique, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK® Matrix</a>.",
       "type": "tactic",
       "@deprecated": {
         "message": "Use the <code> tactic </code> attribute instead.",
@@ -3985,7 +4001,7 @@
     },
     "technique": {
       "caption": "Technique",
-      "description": "The Technique object describes the technique ID and/or name associated to an attack, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK Matrix<sup>TM</sup></a>.",
+      "description": "The Technique object describes the technique ID and/or name associated to an attack, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK® Matrix</a>.",
       "type": "technique"
     },
     "tenant_uid": {

diff --git a/events/remediation/file_remediation.json b/events/remediation/file_remediation.json
@@ -0,0 +1,14 @@
+{
+    "caption": "File Remediation Activity",
+    "description": "File Remediation Activity events report on attempts at remediating files. It follows the MITRE countermeasures defined by the D3FEND™ <a target='_blank' href='https://d3fend.mitre.org/'>Matrix</a>. Sub-techniques will include File, such as File Removal or Restore File.",
+    "extends": "remediation",
+    "name": "file_remediation",
+    "uid": 2,
+    "attributes": {
+      "file": {
+        "description": "The file that pertains to the remediation event.",
+        "group": "primary",
+        "requirement": "required"
+      }
+    }
+  }
diff --git a/events/remediation/network_remediation.json b/events/remediation/network_remediation.json
@@ -0,0 +1,14 @@
+{
+    "caption": "Network Remediation Activity",
+    "description": "Network Remediation Activity events report on attempts at remediating computer networks. It follows the MITRE countermeasures defined by the D3FEND™ <a target='_blank' href='https://d3fend.mitre.org/'>Matrix</a>. Techniques and Sub-techniques will include Network, such as Network Isolation or Network Traffic Filtering.",
+    "extends": "remediation",
+    "name": "network_remediation",
+    "uid": 4,
+    "attributes": {
+      "connection_info": {
+        "description": "The network connection that pertains to the remediation event.",
+        "requirement": "required",
+        "group": "primary"
+      }
+    }
+  }
diff --git a/events/remediation/process_remediation.json b/events/remediation/process_remediation.json
@@ -0,0 +1,14 @@
+{
+    "caption": "Process Remediation Activity",
+    "description": "Process Remediation Activity events report on attempts at remediating processes. It follows the MITRE countermeasures defined by the D3FEND™ <a target='_blank' href='https://d3fend.mitre.org/'>Matrix</a>. Sub-techniques will include Process, such as Process Termination or Kernel-based Process Isolation.",
+    "extends": "remediation",
+    "name": "process_remediation",
+    "uid": 3,
+    "attributes": {
+      "process": {
+        "description": "The process that pertains to the remediation event.",
+        "group": "primary",
+        "requirement": "required"
+      }
+    }
+  }
diff --git a/events/remediation/remediation.json b/events/remediation/remediation.json
@@ -0,0 +1,75 @@
+{
+    "caption": "Remediation Activity",
+    "description": "Remediation Activity events report on attempts at remediating a compromised device or computer network. It follows the MITRE countermeasures defined by the D3FEND™ <a target='_blank' href='https://d3fend.mitre.org/'>Matrix</a>.",
+    "name": "remediation",
+    "category": "remediation",
+    "extends": "base_event",
+    "uid": 1,
+    "profiles": [
+      "host"
+    ],
+    "attributes": {
+      "$include": [
+        "profiles/host.json"
+      ],
+      "activity_id": {
+        "enum": {
+          "1": {
+            "caption": "Isolate",
+            "description": "Creates logical or physical barriers in a system which reduces opportunities for adversaries to create further accesses. Defined by D3FEND™ <a target='_blank' href='https://d3fend.mitre.org/d3f:Isolate/'>d3f:Isolate</a>."
+          },
+          "2": {
+            "caption": "Evict",
+            "description": "Removes an adversary or malicious resource from a device or computer network. Defined by D3FEND™ <a target='_blank' href='https://d3fend.mitre.org/d3f:Evict/'>d3f:Evict</a>."
+          },
+          "3": {
+            "caption": "Restore",
+            "description": "Returns the system to a better state. Defined by D3FEND™ <a target='_blank' href='https://d3fend.mitre.org/d3f:Restore/'>d3f:Restore</a>."
+          },
+          "4": {
+            "caption": "Harden",
+            "description": " Increases the opportunity cost of computer network exploitation. Defined by D3FEND™ <a target='_blank' href='https://d3fend.mitre.org/d3f:Harden/'>d3f:Harden</a>."
+          }
+        },
+        "description": "Matches the MITRE D3FEND™ Tactic. Note: the Model and Detect Tactics are not supported as remediations by the OCSF Remediation event class."
+    },
+      "command_uid": {
+        "description": "The unique identifier of the remediation command that pertains to this event.",
+        "group": "primary",
+        "requirement": "required"
+      },
+      "countermeasures": {
+        "group": "primary",
+        "requirement": "recommended"
+      },
+      "remediation": {
+        "group": "context",
+        "requirement": "optional"
+      },
+      "scan": {
+        "group": "context",
+        "description": "The remediation scan that pertains to this event.",
+        "requirement": "optional"
+      },
+      "status_id": {
+        "enum": {
+            "3": {
+                "caption": "Does Not Exist",
+                "description": "The target of the remediation does not exist."
+            },
+            "4": {
+                "caption": "Partial",
+                "description": "The remediation was partially completed."
+            },
+            "5": {
+                "caption": "Unsupported",
+                "description": "The remediation was not supported."
+            },
+            "6": {
+                "caption": "Error",
+                "description": "There was an error during the remediation process."
+            }
+        }
+      }
+    }
+  }
diff --git a/objects/attack.json b/objects/attack.json
@@ -1,7 +1,7 @@
 {
   "caption": "MITRE ATT&CK®",
   "name": "attack",
-  "description": "The <a target='_blank' href='https://attack.mitre.org'>MITRE ATT&CK®</a> object describes the tactic, technique & sub-technique associated to an attack as defined in <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK Matrix<sup>TM</sup></a>.",
+  "description": "The <a target='_blank' href='https://attack.mitre.org'>MITRE ATT&CK®</a> object describes the tactic, technique & sub-technique associated to an attack as defined in <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK® Matrix</a>.",
   "extends": "object",
   "attributes": {
     "tactic": {
@@ -17,7 +17,7 @@
       "requirement": "optional"
     },
     "version": {
-      "description": "The <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK Matrix<sup>TM</sup></a> version.",
+      "description": "The <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK® Matrix</a> version.",
       "requirement": "recommended"
     }
   },

diff --git a/objects/d3f_tactic.json b/objects/d3f_tactic.json
@@ -0,0 +1,16 @@
+{
+  "caption": "MITRE D3FEND™ Tactic",
+  "description": "The MITRE D3FEND™ Tactic object describes the tactic ID and/or name that is associated to an attack, as defined by <a target='_blank' href='https://d3fend.mitre.org'>D3FEND<sup>TM</sup> Matrix</a>.",
+  "extends": "_entity",
+  "name": "d3f_tactic",
+  "attributes": {
+    "name": {
+      "description": "The tactic name that is associated with the defensive technique, as defined by <a target='_blank' href='https://d3fend.mitre.org'>D3FEND<sup>TM</sup> Matrix</a>. For example: <code>Isolate</code>.",
+      "requirement" : "optional"
+    },    
+    "src_url": {
+      "description": "The versioned permalink of the defensive tactic, as defined by <a target='_blank' href='https://d3fend.mitre.org'>D3FEND<sup>TM</sup> Matrix</a>. For example: <code>https://d3fend.mitre.org/tactic/d3f:Isolate/</code>.",
+      "requirement" : "optional"
+    }
+  }
+}
diff --git a/objects/d3f_technique.json b/objects/d3f_technique.json
@@ -0,0 +1,18 @@
+{
+  "caption": "MITRE DEFEND™ Technique",
+  "description": "The MITRE DEFEND™ Technique object describes the leaf defensive technique ID and/or name associated to a countermeasure, as defined by <a target='_blank' href='https://d3fend.mitre.org'>D3FEND<sup>TM</sup> Matrix</a>.",
+  "extends": "_entity",
+  "name": "d3f_technique",
+  "attributes": {
+    "name": {
+      "description": "The name of the defensive technique, as defined by <a target='_blank' href='https://d3fend.mitre.org'>D3FEND<sup>TM</sup> Matrix</a>. For example: <code>IO Port Restriction</code>."
+    },
+    "src_url": {
+      "description": "The versioned permalink of the defensive technique, as defined by <a target='_blank' href='https://d3fend.mitre.org'>D3FEND<sup>TM</sup> Matrix</a>. For example: <code>https://d3fend.mitre.org/technique/d3f:IOPortRestriction/</code>.",
+      "requirement" : "optional"
+    },
+    "uid": {
+      "description": "The unique identifier of the defensive technique, as defined by <a target='_blank' href='https://mitre.mitre.org'>D3FEND<sup>TM</sup> Matrix</a>. For example: <code>D3-IOPR</code>."
+    }
+  }
+}
diff --git a/objects/d3fend.json b/objects/d3fend.json
@@ -0,0 +1,27 @@
+{
+    "caption": "MITRE D3FEND™",
+    "name": "d3fend",
+    "description": "The <a target='_blank' href='https://d3fend.mitre.org'>MITRE D3FEND™</a> object describes the tactic, technique & sub-technique associated with a countermeasure as defined in <a target='_blank' href='https://https://d3fend.mitre.org/'>DEFEND Matrix<sup>TM</sup></a>.",
+    "extends": "object",
+    "attributes": {
+      "d3f_tactic": {
+        "description": "The Tactic object describes the tactic ID and/or name that is associated with a countermeasure, as defined by <a target='_blank' href='https://d3fend.mitre.org'>D3FEND Matrix<sup>TM</sup></a>.",
+        "requirement": "recommended"
+      },
+      "d3f_technique": {
+        "description": "The Defend Technique object describes the technique ID and/or name associated with a countermeasure, as defined by <a target='_blank' href='https://d3fend.mitre.org'>D3FEND Matrix<sup>TM</sup></a>.",
+        "requirement": "recommended"
+      },
+      "version": {
+        "description": "The <a target='_blank' href='https://d3fend.mitre.org'>D3FEND Matrix<sup>TM</sup></a> version.",
+        "requirement": "recommended"
+      }
+    },
+    "constraints": {
+      "at_least_one": [
+        "d3f_tactic",
+        "d3f_technique"
+      ]
+    }
+  }
+
diff --git a/objects/sub_technique.json b/objects/sub_technique.json
@@ -1,19 +1,19 @@
 {
-  "caption": "Sub Technique",
-  "description": "The Sub Technique object describes the sub technique ID and/or name associated to an attack, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK Matrix<sup>TM</sup></a>.",
+  "caption": "MITRE ATT&CK® Sub Technique",
+  "description": "The MITRE ATT&CK® Sub Technique object describes the sub technique ID and/or name associated to an attack, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK® Matrix</a>.",
   "extends": "_entity",
   "name": "sub_technique",
   "attributes": {
     "name": {
-      "description": "The name of the attack sub technique, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK Matrix<sup>TM</sup></a>. For example: <code>Scanning IP Blocks</code>.",
+      "description": "The name of the attack sub technique, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK® Matrix</a>. For example: <code>Scanning IP Blocks</code>.",
       "requirement" : "optional"
     },
     "src_url": {
-      "description": "The versioned permalink of the attack sub technique, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK Matrix<sup>TM</sup></a>. For example: <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.",
+      "description": "The versioned permalink of the attack sub technique, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK® Matrix</a>. For example: <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.",
       "requirement" : "optional"
     },
     "uid": {
-      "description": "The unique identifier of the attack sub technique, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK Matrix<sup>TM</sup></a>. For example: <code>T1595.001</code>.",
+      "description": "The unique identifier of the attack sub technique, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK® Matrix</a>. For example: <code>T1595.001</code>.",
       "requirement" : "recommended"
     }
   }

diff --git a/objects/tactic.json b/objects/tactic.json
@@ -1,19 +1,19 @@
 {
-  "caption": "Tactic",
-  "description": "The Tactic object describes the tactic ID and/or name that is associated to an attack, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK Matrix<sup>TM</sup></a>.",
+  "caption": "MITRE ATT&CK® Tactic",
+  "description": "The MITRE ATT&CK® Tactic object describes the tactic ID and/or name that is associated to an attack, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK® Matrix</a>.",
   "extends": "_entity",
   "name": "tactic",
   "attributes": {
     "name": {
-      "description": "The tactic name that is associated with the attack technique, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK Matrix<sup>TM</sup></a>. For example: <code>Reconnaissance</code>.",
+      "description": "The tactic name that is associated with the attack technique, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK® Matrix</a>. For example: <code>Reconnaissance</code>.",
       "requirement" : "optional"
     },    
     "src_url": {
-      "description": "The versioned permalink of the attack tactic, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK Matrix<sup>TM</sup></a>. For example: <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.",
+      "description": "The versioned permalink of the attack tactic, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK® Matrix</a>. For example: <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.",
       "requirement" : "optional"
     },
     "uid": {
-      "description": "The tactic ID that is associated with the attack technique, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK Matrix<sup>TM</sup></a>. For example: <code>TA0043</code>.",
+      "description": "The tactic ID that is associated with the attack technique, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK® Matrix</a>. For example: <code>TA0043</code>.",
       "requirement" : "recommended"
     }
   }