Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change naming scheme: Update IDs to be DN0000, LP0000, EN0000 #5

Open
yugoslavskiy opened this issue May 28, 2020 · 6 comments
Open
Assignees

Comments

@yugoslavskiy
Copy link
Member

No description provided.

@mrblacyk mrblacyk self-assigned this Jun 19, 2020
@mrblacyk
Copy link
Member

mmv 'DN_*' 'DN#1'
mmv 'LP_*' 'LP#1'
mmv 'EN_*' 'EN#1'

mrblacyk added a commit that referenced this issue Jun 19, 2020
@yugoslavskiy yugoslavskiy reopened this Jun 26, 2020
@yugoslavskiy
Copy link
Member Author

it's not about filenames, it's about naming scheme in general. see: atc-project/atc-react#294

@mrblacyk
Copy link
Member

@mrblacyk
Copy link
Member

Also following any dependencies in a given file. We just realised this with @sn0w0tter later in the process of implementing another issue

https://github.com/atc-project/atc-data/blob/master/data_needed/DN0001_4688_windows_process_creation.yml#L6

@yugoslavskiy
Copy link
Member Author

sorry, I should have added more context to it.
we need to split ID from the title, and left the title human-readable, not connected to the filename itself.

title: 4688 Windows Process Creation
id: DN0001
author: '@atc_project'
description: Windows process creation log, not including command line
loggingpolicy:
  - LP0001: Windows Audit Process Creation

I am not 100% sure about LP, if it should be LP0001: Windows Audit Process Creation or just LP0001.
This is an open question and I believe we should discuss pros/cons using Descartes square model:

image

@yugoslavskiy
Copy link
Member Author

well, it also makes sense to put EventID into separate field

@yugoslavskiy yugoslavskiy assigned yugoslavskiy and unassigned mrblacyk Oct 5, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants