edoardogerosa/sentinel-attack

Sentinel ATT&CK aims to simplify the rapid deployment of a threat hunting capability that leverages Sysmon and MITRE ATT&CK on Azure Sentinel.

It provides a Sysmon log parser mapped against the OSSEM data model and compatible with the Sysmon Modular XML configuration file.

DISCLAIMER: This tool requires tuning and investigative trialling to be truly effective in a production environment.

Usage

To use the Sentinel-ATT&CK parser, copy-paste it into your Sentinel Logs blade and store it as a function named Sysmon.

A copy of the DEF CON 27 cloud village presentation introducing Sentinel ATT&CK can be found here and here.

Contributing

This repository is work in progress, if you spot any problems we welcome pull requests or submissions on the issue tracker.

Authors and contributors

Sentinel ATT&CK is built with ❤ by:

• Edoardo Gerosa

Special thanks go to the following contributors:

• Olaf Hartong
• Ashwin Patil
• Mor Shabi
• Adrian Corona