{"repo":"mitre-attack/car","free":true,"listed":false,"github":"https://github.com/mitre-attack/car","clone":"git clone https://github.com/mitre-attack/car.git","description":"Cyber Analytics Repository","language":"Python","stars":1021,"topics":["cybersecurity","mitre-corporation","cyber-threat-intelligence","cyber-analytics"],"license":"Apache-2.0","category":"security-tools","readme_excerpt":"Welcome to the Cyber Analytics Repository The MITRE Cyber Analytics Repository (CAR) is a knowledge base of analytics developed by MITRE based on the MITRE ATT&CK® adversary model. CAR includes implementations directly targeted at specific tools (e.g., Splunk, EQL) in its analytics. With respect to coverage, CAR is focused on providing a set of validated and well-explained analytics, in particular with regards to their operating theory and rationale. If you want to start exploring, try viewing the Full Analytic List. Also, check out the ATT&CK Navigator layer that captures the current set of ATT&CK tactics and techniques covered by CAR. Analytics stored in CAR contain the following information: + a hypothesis which explains the idea behind the analytic + the information domain or the primary domain the analytic is designed to operate within (e.g. host, network, process, external) + references to ATT&CK Techniques and Tactics that the analytic detects + the Glossary + a pseudocode description of how the analytic might be implemented + a unit test which can be run to trigger the analytic The best way to view the analytics in this repository is via the CAR website. Methodology CAR analytics were developed to detect the adversary behaviors in ATT&CK. Development of an analytic is based upon the following activities: identifying and prioritizing adversary behaviors from the ATT&CK adversary model identifying the data necessary to detect the adversary behavior identification or cre","default_branch":null,"files":null,"tree":[],"storefront":"/r/mitre-attack","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/mitre-attack/car/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}