Merge pull request #2 from center-for-threat-informed-defense/Team-Fe…

…edback Feedback from team
center-for-threat-informed-defense · Jun 19, 2024 · 07d7a56 · 07d7a56
2 parents ea4b0e7 + a50622a
commit 07d7a56
Show file tree

Hide file tree

Showing 80 changed files with 410 additions and 306 deletions.
diff --git a/docs/Graphics/Question2Graphic.png b/docs/Graphics/Question2Graphic.png
diff --git a/docs/Graphics/Question3Graphic.png b/docs/Graphics/Question3Graphic.png
diff --git a/docs/Graphics/csvExample.csv b/docs/Graphics/csvExample.csv
diff --git a/docs/Graphics/csvExample.xlsx b/docs/Graphics/csvExample.xlsx
diff --git a/docs/Graphics/defenseLayer.svg b/docs/Graphics/defenseLayer.svg
diff --git a/docs/Graphics/introGraphic.png b/docs/Graphics/introGraphic.png
diff --git a/docs/Graphics/question1Graphic.png b/docs/Graphics/question1Graphic.png
diff --git a/docs/Graphics/question4Graphic.png b/docs/Graphics/question4Graphic.png
diff --git a/docs/Graphics/1.png → docs/_static/1.png b/docs/Graphics/1.png → docs/_static/1.png
diff --git a/docs/Graphics/10.png → docs/_static/10.png b/docs/Graphics/10.png → docs/_static/10.png
diff --git a/docs/Graphics/11.png → docs/_static/11.png b/docs/Graphics/11.png → docs/_static/11.png
diff --git a/docs/Graphics/12.png → docs/_static/12.png b/docs/Graphics/12.png → docs/_static/12.png
diff --git a/docs/Graphics/13.png → docs/_static/13.png b/docs/Graphics/13.png → docs/_static/13.png
diff --git a/docs/Graphics/14.png → docs/_static/14.png b/docs/Graphics/14.png → docs/_static/14.png
diff --git a/docs/Graphics/15.png → docs/_static/15.png b/docs/Graphics/15.png → docs/_static/15.png
diff --git a/docs/Graphics/16.png → docs/_static/16.png b/docs/Graphics/16.png → docs/_static/16.png
diff --git a/docs/Graphics/17.png → docs/_static/17.png b/docs/Graphics/17.png → docs/_static/17.png
diff --git a/docs/Graphics/18.png → docs/_static/18.png b/docs/Graphics/18.png → docs/_static/18.png
diff --git a/docs/Graphics/19.png → docs/_static/19.png b/docs/Graphics/19.png → docs/_static/19.png
diff --git a/docs/Graphics/2.png → docs/_static/2.png b/docs/Graphics/2.png → docs/_static/2.png
diff --git a/docs/Graphics/20.svg → docs/_static/20.svg b/docs/Graphics/20.svg → docs/_static/20.svg
diff --git a/docs/Graphics/21.svg → docs/_static/21.svg b/docs/Graphics/21.svg → docs/_static/21.svg
diff --git a/docs/Graphics/22.svg → docs/_static/22.svg b/docs/Graphics/22.svg → docs/_static/22.svg
diff --git a/docs/Graphics/23.svg → docs/_static/23.svg b/docs/Graphics/23.svg → docs/_static/23.svg
diff --git a/docs/Graphics/24.svg → docs/_static/24.svg b/docs/Graphics/24.svg → docs/_static/24.svg
diff --git a/docs/Graphics/25.svg → docs/_static/25.svg b/docs/Graphics/25.svg → docs/_static/25.svg
diff --git a/docs/Graphics/26.png → docs/_static/26.png b/docs/Graphics/26.png → docs/_static/26.png
diff --git a/docs/Graphics/27.png → docs/_static/27.png b/docs/Graphics/27.png → docs/_static/27.png
diff --git a/docs/Graphics/28.png → docs/_static/28.png b/docs/Graphics/28.png → docs/_static/28.png
diff --git a/docs/Graphics/29.png → docs/_static/29.png b/docs/Graphics/29.png → docs/_static/29.png
diff --git a/docs/Graphics/3.png → docs/_static/3.png b/docs/Graphics/3.png → docs/_static/3.png
diff --git a/docs/Graphics/4.png → docs/_static/4.png b/docs/Graphics/4.png → docs/_static/4.png
diff --git a/docs/Graphics/5.png → docs/_static/5.png b/docs/Graphics/5.png → docs/_static/5.png
diff --git a/docs/Graphics/6.png → docs/_static/6.png b/docs/Graphics/6.png → docs/_static/6.png
diff --git a/docs/Graphics/7.png → docs/_static/7.png b/docs/Graphics/7.png → docs/_static/7.png
diff --git a/docs/Graphics/8.png → docs/_static/8.png b/docs/Graphics/8.png → docs/_static/8.png
diff --git a/docs/Graphics/9.png → docs/_static/9.png b/docs/Graphics/9.png → docs/_static/9.png
diff --git a/docs/_static/condensedprocess1.png b/docs/_static/condensedprocess1.png
diff --git a/docs/_static/condensedprocess2.png b/docs/_static/condensedprocess2.png
diff --git a/docs/_static/condensedprocess3.png b/docs/_static/condensedprocess3.png
diff --git a/docs/_static/condensedprocess4.png b/docs/_static/condensedprocess4.png
diff --git a/docs/_static/condensedprocess5.png b/docs/_static/condensedprocess5.png
diff --git a/docs/Graphics/evidenceScoring.png → docs/_static/evidencescoring.png b/docs/Graphics/evidenceScoring.png → docs/_static/evidencescoring.png
diff --git a/docs/Graphics/Identifying_Risk.png → docs/_static/identifying_risk.png b/docs/Graphics/Identifying_Risk.png → docs/_static/identifying_risk.png
diff --git a/docs/_static/intrographic.png b/docs/_static/intrographic.png
diff --git a/docs/_static/mappedcapabilities.csv b/docs/_static/mappedcapabilities.csv
@@ -0,0 +1,84 @@
+Azure Security Capability,Mapping Category,Effectiveness Score,ATT&CK ID,ATT&CK (Sub-)Technique Name
+Alerts for Windows Machines,detect,significant,T1110.003,Password Spraying
+Alerts for Windows Machines,detect,partial,T1087,Account Discovery
+Alerts for Windows Machines,detect,partial,T1110,Brute Force
+Alerts for Windows Machines,detect,partial,T1190,Exploit Public-Facing Application
+Alerts for Windows Machines,detect,partial,T1212,Exploitation for Credential Access
+Alerts for Windows Machines,detect,partial,T1078,Valid Accounts
+Azure Active Directory Password Protection,protect,partial,T1110,Brute Force
+Azure Active Directory Password Protection,protect,partial,T1110.003,Password Spraying
+Azure AD Identity Protection,respond,significant,T1110.003,Password Spraying
+Azure AD Identity Protection,respond,partial,T1078,Valid Accounts
+Azure AD Identity Protection,detect,partial,T1110.003,Password Spraying
+Azure AD Identity Protection,detect,partial,T1078,Valid Accounts
+Azure AD Identity Secure Score,protect,partial,T1110,Brute Force
+Azure AD Identity Secure Score,protect,partial,T1110.003,Password Spraying
+Azure AD Identity Secure Score,protect,partial,T1528,Steal Application Access Token
+Azure AD Multi-Factor Authentication,protect,significant,T1110,Brute Force
+Azure AD Multi-Factor Authentication,protect,significant,T1110.003,Password Spraying
+Azure AD Password Policy,protect,partial,T1110,Brute Force
+Azure AD Privileged Identity Management,protect,significant,T1098.001,Additional Cloud Credentials
+Azure AD Privileged Identity Management,protect,partial,T1098,Account Manipulation
+Azure Alerts for Network Layer,detect,significant,T1110,Brute Force
+Azure Alerts for Network Layer,detect,significant,T1110.003,Password Spraying
+Azure Automation Update Management,protect,significant,T1212,Exploitation for Credential Access
+Azure Automation Update Management,protect,partial,T1190,Exploit Public-Facing Application
+Azure Defender for App Service,detect,partial,T1190,Exploit Public-Facing Application
+Azure Defender for App Service,detect,partial,T1212,Exploitation for Credential Access
+Azure Defender for App Service,detect,partial,T1595.002,Vulnerability Scanning
+Azure Defender for Kubernetes,protect,partial,T1190,Exploit Public-Facing Application
+Azure Defender for Resource Manager,detect,partial,T1526,Cloud Service Discovery
+Azure Defender for Storage,detect,significant,T1530,Data from Cloud Storage
+Azure Firewall,protect,partial,T1595,Active Scanning
+Azure Firewall,protect,partial,T1590,Gather Victim Network Information
+Azure Firewall,protect,partial,T1018,Remote System Discovery
+Azure Firewall,protect,partial,T1595.002,Vulnerability Scanning
+Azure Key Vault,protect,partial,T1528,Steal Application Access Token
+Azure Key Vault,protect,partial,T1522,Unsecured Credentials
+Azure Network Traffic Analytics,detect,partial,T1190,Exploit Public-Facing Application
+Azure Policy,protect,partial,T1110,Brute Force
+Azure Policy,protect,partial,T1526,Cloud Service Discovery
+Azure Policy,protect,partial,T1530,Data from Cloud Storage
+Azure Policy,protect,partial,T1190,Exploit Public-Facing Application
+Azure Policy,protect,partial,T1590,Gather Victim Network Information
+Azure Policy,protect,partial,T1110.003,Password Spraying
+Azure Policy,protect,partial,T1535,Unused/Unsupported Cloud Regions
+Azure Sentinel,detect,partial,T1110,Brute Force
+Azure Sentinel,detect,partial,T1136,Create Account
+Azure Sentinel,detect,partial,T1110.003,Password Spraying
+Azure Sentinel,detect,partial,T1078,Valid Accounts
+Azure Sentinel,detect,partial,T1595.002,Vulnerability Scanning
+Azure Web Application Firewall,protect,significant,T1190,Exploit Public-Facing Application
+Azure Web Application Firewall,protect,partial,T1595,Active Scanning
+Azure Web Application Firewall,protect,partial,T1595.002,Vulnerability Scanning
+Azure Web Application Firewall,detect,significant,T1190,Exploit Public-Facing Application
+Azure Web Application Firewall,detect,partial,T1595.002,Vulnerability Scanning
+Cloud App Security Policies,protect,partial,T1119,Automated Collection
+Cloud App Security Policies,protect,partial,T1528,Steal Application Access Token
+Cloud App Security Policies,detect,partial,T1119,Automated Collection
+Cloud App Security Policies,detect,partial,T1110,Brute Force
+Cloud App Security Policies,detect,partial,T1526,Cloud Service Discovery
+Cloud App Security Policies,detect,partial,T1530,Data from Cloud Storage
+Cloud App Security Policies,detect,partial,T1110.003,Password Spraying
+Cloud App Security Policies,detect,partial,T1528,Steal Application Access Token
+Cloud App Security Policies,detect,partial,T1535,Unused/Unsupported Cloud Regions
+Cloud App Security Policies,detect,partial,T1078,Valid Accounts
+Conditional Access,protect,significant,T1110,Brute Force
+Conditional Access,protect,significant,T1110.003,Password Spraying
+File Integrity Monitoring,detect,partial,T1222,File and Directory Permissions Modification
+File Integrity Monitoring,detect,partial,T1556,Modify Authentication Process
+Integrated Vulnerability Scanner Powered by Qualys,protect,partial,T1190,Exploit Public-Facing Application
+Integrated Vulnerability Scanner Powered by Qualys,protect,partial,T1212,Exploitation for Credential Access
+Just-in-Time VM Access,protect,significant,T1110,Brute Force
+Just-in-Time VM Access,protect,significant,T1110.003,Password Spraying
+Linux auditd alerts and Log Analytics agent integration,detect,partial,T1110,Brute Force
+Linux auditd alerts and Log Analytics agent integration,detect,partial,T1110.003,Password Spraying
+Microsoft Defender for Identity,detect,significant,T1110.003,Password Spraying
+Microsoft Defender for Identity,detect,partial,T1098,Account Manipulation
+Microsoft Defender for Identity,detect,partial,T1110,Brute Force
+Passwordless Authentication,protect,significant,T1110,Brute Force
+Passwordless Authentication,protect,significant,T1110.003,Password Spraying
+Role Based Access Control,protect,partial,T1098,Account Manipulation
+Role Based Access Control,protect,partial,T1098.001,Additional Cloud Credentials
+Role Based Access Control,protect,partial,T1530,Data from Cloud Storage
+Role Based Access Control,protect,partial,T1528,Steal Application Access Token
diff --git a/docs/_static/mappedtechniques.csv b/docs/_static/mappedtechniques.csv
@@ -0,0 +1,84 @@
+ATT&CK (Sub-)Technique Name,ATT&CK ID,Mapping Category,Effectiveness Score,Azure Security Capability
+Account Discovery,T1087,detect,partial,Alerts for Windows Machines
+Account Manipulation,T1098,protect,partial,Azure AD Privileged Identity Management
+Account Manipulation,T1098,protect,partial,Role Based Access Control
+Account Manipulation,T1098,detect,partial,Microsoft Defender for Identity
+Active Scanning,T1595,protect,partial,Azure Firewall
+Active Scanning,T1595,protect,partial,Azure Web Application Firewall
+Additional Cloud Credentials,T1098.001,protect,significant,Azure AD Privileged Identity Management
+Additional Cloud Credentials,T1098.001,protect,partial,Role Based Access Control
+Automated Collection,T1119,protect,partial,Cloud App Security Policies
+Automated Collection,T1119,detect,partial,Cloud App Security Policies
+Brute Force,T1110,protect,significant,Azure AD Multi-Factor Authentication
+Brute Force,T1110,protect,significant,Conditional Access
+Brute Force,T1110,protect,significant,Just-in-Time VM Access
+Brute Force,T1110,protect,significant,Passwordless Authentication
+Brute Force,T1110,protect,partial,Azure Active Directory Password Protection
+Brute Force,T1110,protect,partial,Azure AD Identity Secure Score
+Brute Force,T1110,protect,partial,Azure AD Password Policy
+Brute Force,T1110,protect,partial,Azure Policy
+Brute Force,T1110,detect,significant,Azure Alerts for Network Layer
+Brute Force,T1110,detect,partial,Alerts for Windows Machines
+Brute Force,T1110,detect,partial,Azure Sentinel
+Brute Force,T1110,detect,partial,Cloud App Security Policies
+Brute Force,T1110,detect,partial,Linux auditd alerts and Log Analytics agent integration
+Brute Force,T1110,detect,partial,Microsoft Defender for Identity
+Cloud Service Discovery,T1526,protect,partial,Azure Policy
+Cloud Service Discovery,T1526,detect,partial,Azure Defender for Resource Manager
+Cloud Service Discovery,T1526,detect,partial,Cloud App Security Policies
+Create Account,T1136,detect,partial,Azure Sentinel
+Data from Cloud Storage,T1530,protect,partial,Azure Policy
+Data from Cloud Storage,T1530,protect,partial,Role Based Access Control
+Data from Cloud Storage,T1530,detect,significant,Azure Defender for Storage
+Data from Cloud Storage,T1530,detect,partial,Cloud App Security Policies
+Exploit Public-Facing Application,T1190,protect,significant,Azure Web Application Firewall
+Exploit Public-Facing Application,T1190,protect,partial,Azure Automation Update Management
+Exploit Public-Facing Application,T1190,protect,partial,Azure Defender for Kubernetes
+Exploit Public-Facing Application,T1190,protect,partial,Azure Policy
+Exploit Public-Facing Application,T1190,protect,partial,Integrated Vulnerability Scanner Powered by Qualys
+Exploit Public-Facing Application,T1190,detect,significant,Azure Web Application Firewall
+Exploit Public-Facing Application,T1190,detect,partial,Alerts for Windows Machines
+Exploit Public-Facing Application,T1190,detect,partial,Azure Defender for App Service
+Exploit Public-Facing Application,T1190,detect,partial,Azure Network Traffic Analytics
+Exploitation for Credential Access,T1212,protect,significant,Azure Automation Update Management
+Exploitation for Credential Access,T1212,protect,partial,Integrated Vulnerability Scanner Powered by Qualys
+Exploitation for Credential Access,T1212,detect,partial,Alerts for Windows Machines
+Exploitation for Credential Access,T1212,detect,partial,Azure Defender for App Service
+File and Directory Permissions Modification,T1222,detect,partial,File Integrity Monitoring
+Gather Victim Network Information,T1590,protect,partial,Azure Firewall
+Gather Victim Network Information,T1590,protect,partial,Azure Policy
+Modify Authentication Process,T1556,detect,partial,File Integrity Monitoring
+Password Spraying,T1110.003,respond,significant,Azure AD Identity Protection
+Password Spraying,T1110.003,protect,significant,Azure AD Multi-Factor Authentication
+Password Spraying,T1110.003,protect,significant,Conditional Access
+Password Spraying,T1110.003,protect,significant,Just-in-Time VM Access
+Password Spraying,T1110.003,protect,significant,Passwordless Authentication
+Password Spraying,T1110.003,protect,partial,Azure Active Directory Password Protection
+Password Spraying,T1110.003,protect,partial,Azure AD Identity Secure Score
+Password Spraying,T1110.003,protect,partial,Azure Policy
+Password Spraying,T1110.003,detect,significant,Alerts for Windows Machines
+Password Spraying,T1110.003,detect,significant,Azure Alerts for Network Layer
+Password Spraying,T1110.003,detect,significant,Microsoft Defender for Identity
+Password Spraying,T1110.003,detect,partial,Azure AD Identity Protection
+Password Spraying,T1110.003,detect,partial,Azure Sentinel
+Password Spraying,T1110.003,detect,partial,Cloud App Security Policies
+Password Spraying,T1110.003,detect,partial,Linux auditd alerts and Log Analytics agent integration
+Remote System Discovery,T1018,protect,partial,Azure Firewall
+Steal Application Access Token,T1528,protect,partial,Azure AD Identity Secure Score
+Steal Application Access Token,T1528,protect,partial,Azure Key Vault
+Steal Application Access Token,T1528,protect,partial,Cloud App Security Policies
+Steal Application Access Token,T1528,protect,partial,Role Based Access Control
+Steal Application Access Token,T1528,detect,partial,Cloud App Security Policies
+Unsecured Credentials,T1522,protect,partial,Azure Key Vault
+Unused/Unsupported Cloud Regions,T1535,protect,partial,Azure Policy
+Unused/Unsupported Cloud Regions,T1535,detect,partial,Cloud App Security Policies
+Valid Accounts,T1078,respond,partial,Azure AD Identity Protection
+Valid Accounts,T1078,detect,partial,Alerts for Windows Machines
+Valid Accounts,T1078,detect,partial,Azure AD Identity Protection
+Valid Accounts,T1078,detect,partial,Azure Sentinel
+Valid Accounts,T1078,detect,partial,Cloud App Security Policies
+Vulnerability Scanning,T1595.002,protect,partial,Azure Firewall
+Vulnerability Scanning,T1595.002,protect,partial,Azure Web Application Firewall
+Vulnerability Scanning,T1595.002,detect,partial,Azure Defender for App Service
+Vulnerability Scanning,T1595.002,detect,partial,Azure Sentinel
+Vulnerability Scanning,T1595.002,detect,partial,Azure Web Application Firewall
diff --git a/docs/_static/mappingsexplorer.png b/docs/_static/mappingsexplorer.png
diff --git a/docs/Graphics/Platform_Layer.svg → docs/_static/platform_layer.svg b/docs/Graphics/Platform_Layer.svg → docs/_static/platform_layer.svg
diff --git a/docs/_static/projectphoto.png b/docs/_static/projectphoto.png
diff --git a/docs/_static/protection_layer.svg b/docs/_static/protection_layer.svg
diff --git a/docs/_static/question1graphic.png b/docs/_static/question1graphic.png
diff --git a/docs/_static/question2graphic.png b/docs/_static/question2graphic.png
diff --git a/docs/_static/question3graphic.png b/docs/_static/question3graphic.png
diff --git a/docs/_static/question4graphic.png b/docs/_static/question4graphic.png
diff --git a/docs/Graphics/RiskLayer.svg → docs/_static/risklayer.svg b/docs/Graphics/RiskLayer.svg → docs/_static/risklayer.svg
diff --git a/docs/Graphics/ScoringLayer.svg → docs/_static/scoringlayer.svg b/docs/Graphics/ScoringLayer.svg → docs/_static/scoringlayer.svg
diff --git a/docs/_static/theory.svg b/docs/_static/theory.svg
diff --git a/docs/_static/theory_evidence.svg b/docs/_static/theory_evidence.svg
diff --git a/docs/Graphics/theoryEvidenceTTPs.png → docs/_static/theoryevidencettps.png b/docs/Graphics/theoryEvidenceTTPs.png → docs/_static/theoryevidencettps.png
diff --git a/docs/Graphics/theoryScoring.png → docs/_static/theoryscoring.png b/docs/Graphics/theoryScoring.png → docs/_static/theoryscoring.png
diff --git a/docs/Graphics/theoryvsEvidence.png → docs/_static/theoryvsevidence.png b/docs/Graphics/theoryvsEvidence.png → docs/_static/theoryvsevidence.png