Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Generate IR ready reports on detections #36

Closed
qjerome opened this issue May 22, 2021 · 0 comments
Closed

Generate IR ready reports on detections #36

qjerome opened this issue May 22, 2021 · 0 comments
Labels
enhancement New feature or request next-release feature available in next release

Comments

@qjerome
Copy link
Contributor

qjerome commented May 22, 2021

The idea is to create reports for IR when detection triggers

  • can be managed the same way artifacts are dumps
  • use OSQuery for generating reports as it provides standard JSON output
  • implements an action to do that too
@qjerome qjerome added enhancement New feature or request next-release feature available in next release labels May 22, 2021
qjerome added a commit that referenced this issue Jun 22, 2021
@qjerome
Refactoring:
9e12a1a 
    - hids package
    - hook functions taking hids as first parameter to easily access config from hooks
    - removed global variables shared between hooks and HIDS
    - manager command handler moved from api package to hids to easily access hids config

Fixed issues:
    - Implement actionnable rules: #28
    - Implement event count: #29
    - Enrich events with signature information: #32
    - Automatic canary folder management: #33
    - Ability to configure audit policies from WHIDS config: #34
    - Set File System Audit ACLs from config: #35
    - Generate IR ready reports on detections: #36
    - Dump process tree: #38
    - Enrich event with Gene process scoring: #40
    - Add Admin API to list and download artifacts dumped: #42
    - Directory listing command: #44
    - Implement hash command: #45
    - Implement osquery command: #46
    - Implement terminate command: #47
    - Implement stat command: #48
    - Implement walk command: #49
    - Implement find command: #50
    - Implement report command: #51
    - Implement processes command: #52
    - Implement drivers command: #53
@qjerome qjerome closed this as completed Sep 21, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request next-release feature available in next release
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@qjerome