Uniquely identify Windows events for automated data collection #55
Description
Dear OSSEM-DM Team,
thanks for your great work! I have worked with your detection model relationships to extract Windows events that would be required for comprehensive monitoring in a Windows domain. In a past version of your generated relationships (_all_ossem_relationships.yml), you always specified the channel (log_channel), provider (log_source) and event_id for each referenced Windows-based security event. This allowed to generate corresponding log policies and Windows event subscriptions to retrieve those events.
In a newer version of your specification, those fields have a changed semantics (log_source) or have been removed (log_channel). This makes the automated derivation of required events much more difficult or even impossible. Is it planned that this information is reintroduced, maybe under a different key name? If not, do you see any other way to retrieve the channel and provider from the relationship data, maybe with some mapping table?
While the simple cases of Microsoft-Windows-Security-Auditing and sysmon could be mapped to the channel/provider-pairs Security:Microsoft-Windows-Security-Auditing and Microsoft-Windows-Sysmon/Operational:Microsoft-Windows-Sysmon, this becomes much more difficult for event providers that log into multiple channels, such as Microsoft-Windows-Eventlog. So in order to derive the corresponding WEF subscription or generally event filter, I would have to know which event_id belongs to which channel/provider pair. On the other hand, there are some log sources that go into two different providers (and channels), like Powershell. Powershell seems to be covered now by the two log_sources powershell and Microsoft-Windows-PowerShell. powershell seems to be used for the two providers PowerShell (channel: Windows PowerShell) and Microsoft-Windows-PowerShell (channel: Microsoft-Windows-PowerShell/Operational). Hence, it cannot be determined automatically (or manually without additional knowledge of existing events) whether events should be collected from either Windows PowerShell or Microsoft-Windows-PowerShell/Operational channel.