Skip to content

v0.6.0 — materialized MITRE CAR

Latest
Latest

Choose a tag to compare

View all tags
@Get-Sybers Get-Sybers released this 30 Aug 11:52
· 34 commits to main since this release
v0.6.0
a53acce
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The MITRE CAR layer is now materialized end-to-end.

  • 13 mitre.car_<object> tables + car_relationships (superset edges); Car()/CarObjects() views.
  • dxdfir build-car → dxdfir ingest --only car → mitre.car_*; dxdfir car-timeline.
  • verify-car rewritten against the materialized tables (car_action validated against the engine model vocabulary).
  • Zimmerman (EZ-Tools) lane → CAR.
  • Removed: the query-time Car*() KQL functions (no backwards compatibility) and the Velociraptor lane.
Assets 2
Loading