The Open Source Security Events Metadata (OSSEM) is a community-led project that focuses primarily on the documentation and standardization of security event logs from diverse data sources and operating systems.
Security events are documented in a dictionary format and can be used as a reference for projects like the ThreatHunter-Playbook while mapping data sources to data analytics used to validate the detection of adversarial techniques.
In addition, the project provides a common information model (CIM) that can be used for data engineers during data normalization procedures to allow security analysts to query and analyze data across diverse data sources.
Finally, the project also provides documentation about the structure and relationships identified in specific data sources to facilitate the development of data analytics.
Goals
Define and share a common information model in order to improve the data standardization and transformation of security event logs
Define and share data structures and relationships identified in security events logs
Provide detailed information in a dictionary format about several security event logs to the community
Learn more about security event logs (Windows, Linux & MacOS)
Have fun and think more about the data structure in your SIEM when it comes down to detection!!
Facilitates the normalization of data sets by providing a standard way to parse security event logs
It is organized by specific entities associated with event logs and defined in more details by Data Dictionaries
The definitions of each entity and its respective field names are mostly general descriptions that could help and expedite event logs parsing procedures.
Contains specific information about several security event logs organized by operating system and their respective data sets
Each dictionary describes a single event log and its corresponding event field names
The difference between the Common Information Model folder and the data dictionaries is that in the CIM the field definitions are more general whereas in a data dictionary, each field name definition is unique to the specific event log.
Focuses on defining the required data in form of data objects and the relationships among each other needed to facilitate the creation of data analytics and validate the detection of adversary techniques
This is inspired by the awesome work of MITRE with their project CAR Analytics
The information needed for each data object is pulled from the entities defined in the Common Information Model
Focuses on the documentation of data sources suggested or associated with techniques defined in the Enterprise Matrix
In addition, here is where data sources will be mapped with specific data objects defined in the Detection Data Model part of the project with the main goal of creating a link between techniques, data sources and data analytics
Current Status: Alpha
The project is currently in an alpha stage, which means that the content is still changing. We welcome any feedback and suggestions to improve the project.