Restructure

ashleyse2016 · Jun 24, 2021 · 54c680c · 54c680c
1 parent 89733fd
commit 54c680c
Show file tree

Hide file tree

Showing 89 changed files with 16 additions and 24 deletions.
diff --git a/.gitmodules b/.gitmodules
@@ -1,24 +1,24 @@
-[submodule "Incident-Response-Tools/Aurora-Incident-Response"]
-	path = Incident-Response-Tools/Aurora-Incident-Response
+[submodule "Tools/Aurora-Incident-Response"]
+	path = Tools/Aurora-Incident-Response
 	url = https://github.com/cyb3rfox/Aurora-Incident-Response.git
-[submodule "Incident-Response-Tools/grr"]
-	path = Incident-Response-Tools/grr
+[submodule "Tools/grr"]
+	path = Tools/grr
 	url = https://github.com/google/grr.git
-[submodule "Incident-Response-Tools/Loki"]
-	path = Incident-Response-Tools/Loki
+[submodule "Tools/Loki"]
+	path = Tools/Loki
 	url = https://github.com/Neo23x0/Loki.git
-[submodule "Incident-Response-Tools/cyphon"]
-	path = Incident-Response-Tools/cyphon
+[submodule "Tools/cyphon"]
+	path = Tools/cyphon
 	url = https://github.com/cyphonmdr/cyphon.git
-[submodule "Incident-Response-Tools/dfirtrack"]
-	path = Incident-Response-Tools/dfirtrack
+[submodule "Tools/dfirtrack"]
+	path = Tools/dfirtrack
 	url = https://github.com/stuhli/dfirtrack.git
-[submodule "Incident-Response-Tools/TheHive"]
-	path = Incident-Response-Tools/TheHive
+[submodule "Tools/TheHive"]
+	path = Tools/TheHive
 	url = https://github.com/TheHive-Project/TheHive.git
-[submodule "Incident-Response-Tools/beagle"]
-	path = Incident-Response-Tools/beagle
+[submodule "Tools/beagle"]
+	path = Tools/beagle
 	url = https://github.com/yampelo/beagle.git
-[submodule "Incident-Response-Tools/Meerkat"]
-	path = Incident-Response-Tools/Meerkat
+[submodule "Tools/Meerkat"]
+	path = Tools/Meerkat
 	url = https://github.com/TonyPhipps/Meerkat.git
diff --git a/Incident-Response-After/Postmortem/README.md → Automations/Automation-Examples/README.md b/Incident-Response-After/Postmortem/README.md → Automations/Automation-Examples/README.md
diff --git a/Incident-Response-After/README.md → ...mations/Bash-Automation-Scripts/README.md b/Incident-Response-After/README.md → ...mations/Bash-Automation-Scripts/README.md
diff --git a/...Automations/Automation-Examples/README.md → Automations/GO-Automation-Scripts/README.md b/...Automations/Automation-Examples/README.md → Automations/GO-Automation-Scripts/README.md
diff --git a/...mations/Bash-Automation-Scripts/README.md → ...tions/Python-Automation-Scripts/README.md b/...mations/Bash-Automation-Scripts/README.md → ...tions/Python-Automation-Scripts/README.md
diff --git a/Incident-Response-Automations/README.md → Automations/README.md b/Incident-Response-Automations/README.md → Automations/README.md
diff --git a/...tomations/GO-Automation-Scripts/README.md → ...mations/Ruby-Automation-Scripts/README.md b/...tomations/GO-Automation-Scripts/README.md → ...mations/Ruby-Automation-Scripts/README.md
diff --git a/...tions/Python-Automation-Scripts/README.md → .../SOAR-Automations/DFLabs IncMan/README.md b/...tions/Python-Automation-Scripts/README.md → .../SOAR-Automations/DFLabs IncMan/README.md
diff --git a/...mations/Ruby-Automation-Scripts/README.md → ...ions/Exabeam incident responder/README.md b/...mations/Ruby-Automation-Scripts/README.md → ...ions/Exabeam incident responder/README.md
diff --git a/.../SOAR-Automations/DFLabs IncMan/README.md → ...s/FireEye Security Orchestrator/README.md b/.../SOAR-Automations/DFLabs IncMan/README.md → ...s/FireEye Security Orchestrator/README.md
diff --git a/...ions/Exabeam incident responder/README.md → ...-Automations/LogRhythm RespondX/README.md b/...ions/Exabeam incident responder/README.md → ...-Automations/LogRhythm RespondX/README.md
diff --git a/...s/FireEye Security Orchestrator/README.md → ...ons/RSA NetWitness Orchestrator/README.md b/...s/FireEye Security Orchestrator/README.md → ...ons/RSA NetWitness Orchestrator/README.md
diff --git a/...-Automations/LogRhythm RespondX/README.md → ...omations/Rapid7 Insightconnect /README.md b/...-Automations/LogRhythm RespondX/README.md → ...omations/Rapid7 Insightconnect /README.md
diff --git a/...ons/RSA NetWitness Orchestrator/README.md → Automations/SOAR-Automations/SIRP/README.md b/...ons/RSA NetWitness Orchestrator/README.md → Automations/SOAR-Automations/SIRP/README.md
diff --git a/...omations/Rapid7 Insightconnect /README.md → ...ons/SOAR-Automations/ServiceNow/README.md b/...omations/Rapid7 Insightconnect /README.md → ...ons/SOAR-Automations/ServiceNow/README.md
diff --git a/...tomations/SOAR-Automations/SIRP/README.md → ...ions/SOAR-Automations/Siemplify/README.md b/...tomations/SOAR-Automations/SIRP/README.md → ...ions/SOAR-Automations/Siemplify/README.md
diff --git a/...ons/SOAR-Automations/ServiceNow/README.md → ...SOAR-Automations/Splunk Phantom/README.md b/...ons/SOAR-Automations/ServiceNow/README.md → ...SOAR-Automations/Splunk Phantom/README.md
diff --git a/...ions/SOAR-Automations/Siemplify/README.md → ...tions/SOAR-Automations/Swimlane/README.md b/...ions/SOAR-Automations/Siemplify/README.md → ...tions/SOAR-Automations/Swimlane/README.md
diff --git a/...SOAR-Automations/Splunk Phantom/README.md → .../SOAR-Automations/ThreatConnect/README.md b/...SOAR-Automations/Splunk Phantom/README.md → .../SOAR-Automations/ThreatConnect/README.md
diff --git a/Incident-Response-Battle-Cards/README.md → Battle-Cards/README.md b/Incident-Response-Battle-Cards/README.md → Battle-Cards/README.md
diff --git a/...Response-Battle-Cards/T1486-Ransomware.md → Battle-Cards/T1486-Ransomware.md b/...Response-Battle-Cards/T1486-Ransomware.md → Battle-Cards/T1486-Ransomware.md
diff --git a/...employee was not off-boarded correctly.md → ...employee was not off-boarded correctly.md b/...employee was not off-boarded correctly.md → ...employee was not off-boarded correctly.md
diff --git a/...has received sensitive documents data.md → ...has received sensitive documents data.md b/...has received sensitive documents data.md → ...has received sensitive documents data.md
diff --git a/... has been stolen and was not encrypted.md → ... has been stolen and was not encrypted.md b/... has been stolen and was not encrypted.md → ... has been stolen and was not encrypted.md
diff --git a/...email has been accessed by an outsider.md → ...email has been accessed by an outsider.md b/...email has been accessed by an outsider.md → ...email has been accessed by an outsider.md
diff --git a/... Employee communications were compromised → ... Employee communications were compromised b/... Employee communications were compromised → ... Employee communications were compromised
diff --git a/...osed to, and indexed by, a search engine. → ...osed to, and indexed by, a search engine. b/...osed to, and indexed by, a search engine. → ...osed to, and indexed by, a search engine.
diff --git a/...ontaining sensitive data has been lost.md → ...ontaining sensitive data has been lost.md b/...ontaining sensitive data has been lost.md → ...ontaining sensitive data has been lost.md
diff --git a/...ident to deal with a vendor compromise.md → ...ident to deal with a vendor compromise.md b/...ident to deal with a vendor compromise.md → ...ident to deal with a vendor compromise.md
diff --git a/Incident-Response-Exercises/README.md → Exercises/README.md b/Incident-Response-Exercises/README.md → Exercises/README.md
diff --git a/Incident-Response-Tools/Aurora-Incident-Response b/Incident-Response-Tools/Aurora-Incident-Response
diff --git a/Incident-Response-Tools/Loki b/Incident-Response-Tools/Loki
diff --git a/Incident-Response-Tools/Meerkat b/Incident-Response-Tools/Meerkat
diff --git a/Incident-Response-Tools/TheHive b/Incident-Response-Tools/TheHive
diff --git a/Incident-Response-Tools/beagle b/Incident-Response-Tools/beagle
diff --git a/Incident-Response-Tools/cyphon b/Incident-Response-Tools/cyphon
diff --git a/Incident-Response-Tools/dfirtrack b/Incident-Response-Tools/dfirtrack
diff --git a/Incident-Response-Tools/grr b/Incident-Response-Tools/grr
diff --git a/...sponse-After/After Action Review (AAR).md → ...sponse-After/After Action Review (AAR).md b/...sponse-After/After Action Review (AAR).md → ...sponse-After/After Action Review (AAR).md
diff --git a/...tions/SOAR-Automations/Swimlane/README.md → ...ident-Response-After/Postmortem/README.md b/...tions/SOAR-Automations/Swimlane/README.md → ...ident-Response-After/Postmortem/README.md
diff --git a/.../SOAR-Automations/ThreatConnect/README.md → ...esponse/Incident-Response-After/README.md b/.../SOAR-Automations/ThreatConnect/README.md → ...esponse/Incident-Response-After/README.md
diff --git a/...esponse-Artifacts/Host-Based Artifacts.md → ...esponse-Artifacts/Host-Based Artifacts.md b/...esponse-Artifacts/Host-Based Artifacts.md → ...esponse-Artifacts/Host-Based Artifacts.md
diff --git a/...nformation to Review for Host Analysis.md → ...nformation to Review for Host Analysis.md b/...nformation to Review for Host Analysis.md → ...nformation to Review for Host Analysis.md
diff --git a/...onse-Artifacts/Network-Based Artifacts.md → ...onse-Artifacts/Network-Based Artifacts.md b/...onse-Artifacts/Network-Based Artifacts.md → ...onse-Artifacts/Network-Based Artifacts.md
diff --git a/...lists/Account Takeover (ATO) Checklist.md → ...lists/Account Takeover (ATO) Checklist.md b/...lists/Account Takeover (ATO) Checklist.md → ...lists/Account Takeover (ATO) Checklist.md
diff --git a/...ts/Best Practices Prior to an Incident.md → ...ts/Best Practices Prior to an Incident.md b/...ts/Best Practices Prior to an Incident.md → ...ts/Best Practices Prior to an Incident.md
diff --git a/...eview Checklist for Security Incidents.md → ...eview Checklist for Security Incidents.md b/...eview Checklist for Security Incidents.md → ...eview Checklist for Security Incidents.md
diff --git a/Incident-Response-Checklists/Mitigations.md → ...cident-Response-Checklists/Mitigations.md b/Incident-Response-Checklists/Mitigations.md → ...cident-Response-Checklists/Mitigations.md
diff --git a/...e Investigative Plan and Incident File.md → ...e Investigative Plan and Incident File.md b/...e Investigative Plan and Incident File.md → ...e Investigative Plan and Incident File.md
diff --git a/...hases/01. Investigate/Analyze Evidence.md → ...hases/01. Investigate/Analyze Evidence.md b/...hases/01. Investigate/Analyze Evidence.md → ...hases/01. Investigate/Analyze Evidence.md
diff --git a/...hases/01. Investigate/Collect Evidence.md → ...hases/01. Investigate/Collect Evidence.md b/...hases/01. Investigate/Collect Evidence.md → ...hases/01. Investigate/Collect Evidence.md
diff --git a/...e-Phases/01. Investigate/Collect Leads.md → ...e-Phases/01. Investigate/Collect Leads.md b/...e-Phases/01. Investigate/Collect Leads.md → ...e-Phases/01. Investigate/Collect Leads.md
diff --git a/...Deploy Indicators of Compromise (IOCs).md → ...Deploy Indicators of Compromise (IOCs).md b/...Deploy Indicators of Compromise (IOCs).md → ...Deploy Indicators of Compromise (IOCs).md
diff --git a/...Response-Phases/01. Investigate/README.md → ...Response-Phases/01. Investigate/README.md b/...Response-Phases/01. Investigate/README.md → ...Response-Phases/01. Investigate/README.md
diff --git a/...s/01. Investigate/create-incident-file.md → ...s/01. Investigate/create-incident-file.md b/...s/01. Investigate/create-incident-file.md → ...s/01. Investigate/create-incident-file.md
diff --git a/...t-Response-Phases/02. Remediate/README.md → ...t-Response-Phases/02. Remediate/README.md b/...t-Response-Phases/02. Remediate/README.md → ...t-Response-Phases/02. Remediate/README.md
diff --git a/.../02. Remediate/Update Remediation Plan.md → .../02. Remediate/Update Remediation Plan.md b/.../02. Remediate/Update Remediation Plan.md → .../02. Remediate/Update Remediation Plan.md
diff --git a/...03. Communicate/Communicate Externally.md → ...03. Communicate/Communicate Externally.md b/...03. Communicate/Communicate Externally.md → ...03. Communicate/Communicate Externally.md
diff --git a/...03. Communicate/Communicate Internally.md → ...03. Communicate/Communicate Internally.md b/...03. Communicate/Communicate Internally.md → ...03. Communicate/Communicate Internally.md
diff --git a/...Response-Phases/03. Communicate/README.md → ...Response-Phases/03. Communicate/README.md b/...Response-Phases/03. Communicate/README.md → ...Response-Phases/03. Communicate/README.md
diff --git a/...ent-Response-Phases/04. Recover/README.md → ...ent-Response-Phases/04. Recover/README.md b/...ent-Response-Phases/04. Recover/README.md → ...ent-Response-Phases/04. Recover/README.md
diff --git a/Incident-Response-Phases/README.md → ...sponse/Incident-Response-Phases/README.md b/Incident-Response-Phases/README.md → ...sponse/Incident-Response-Phases/README.md
diff --git a/...ITRE-ATTACK/Command and Control/README.md → ...esponse/Incident-Response-Roles/README.md b/...ITRE-ATTACK/Command and Control/README.md → ...esponse/Incident-Response-Roles/README.md
diff --git a/.../MITRE-ATTACK/Credential Access/README.md → ...dent-Response/Policy-Generation/README.md b/.../MITRE-ATTACK/Credential Access/README.md → ...dent-Response/Policy-Generation/README.md
diff --git a/Incident-Response-Playbooks/CVE/README.md → Playbooks/CVE/README.md b/Incident-Response-Playbooks/CVE/README.md → Playbooks/CVE/README.md
diff --git a/...e-Playbooks/General/0Day-vulnerability.md → Playbooks/General/0Day-vulnerability.md b/...e-Playbooks/General/0Day-vulnerability.md → Playbooks/General/0Day-vulnerability.md
diff --git a/Incident-Response-Playbooks/General/IAM.md → Playbooks/General/IAM.md b/Incident-Response-Playbooks/General/IAM.md → Playbooks/General/IAM.md
diff --git a/...-Playbooks/General/Information-Leakage.md → Playbooks/General/Information-Leakage.md b/...-Playbooks/General/Information-Leakage.md → Playbooks/General/Information-Leakage.md
diff --git a/...sponse-Playbooks/General/Insider-Abuse.md → Playbooks/General/Insider-Abuse.md b/...sponse-Playbooks/General/Insider-Abuse.md → Playbooks/General/Insider-Abuse.md
diff --git a/...ooks/General/Linux-Intrusion-Detection.md → ...ooks/General/Linux-Intrusion-Detection.md b/...ooks/General/Linux-Intrusion-Detection.md → ...ooks/General/Linux-Intrusion-Detection.md
diff --git a/...ks/General/Malicious-Network-Behaviour.md → ...ks/General/Malicious-Network-Behaviour.md b/...ks/General/Malicious-Network-Behaviour.md → ...ks/General/Malicious-Network-Behaviour.md
diff --git a/...ent-Response-Playbooks/General/Malware.md → Playbooks/General/Malware.md b/...ent-Response-Playbooks/General/Malware.md → Playbooks/General/Malware.md
diff --git a/...ks/General/Windows-Intrusion-Detection.md → ...ks/General/Windows-Intrusion-Detection.md b/...ks/General/Windows-Intrusion-Detection.md → ...ks/General/Windows-Intrusion-Detection.md
diff --git a/...ollection/T1114-Cloud-Email-Compromise.md → ...ollection/T1114-Cloud-Email-Compromise.md b/...ollection/T1114-Cloud-Email-Compromise.md → ...ollection/T1114-Cloud-Email-Compromise.md
diff --git a/...laybooks/MITRE-ATTACK/Execution/README.md → ...ITRE-ATTACK/Command and Control/README.md b/...laybooks/MITRE-ATTACK/Execution/README.md → ...ITRE-ATTACK/Command and Control/README.md
diff --git a/...books/MITRE-ATTACK/Exfiltration/README.md → .../MITRE-ATTACK/Credential Access/README.md b/...books/MITRE-ATTACK/Exfiltration/README.md → .../MITRE-ATTACK/Credential Access/README.md
diff --git a/...ial Access/T1110.003-Password Spraying.md → ...ial Access/T1110.003-Password Spraying.md b/...ial Access/T1110.003-Password Spraying.md → ...ial Access/T1110.003-Password Spraying.md
diff --git a/...efense Evasion/T1055-Process-Injection.md → ...efense Evasion/T1055-Process-Injection.md b/...efense Evasion/T1055-Process-Injection.md → ...efense Evasion/T1055-Process-Injection.md
diff --git a/...s/MITRE-ATTACK/Lateral Movement/README.md → Playbooks/MITRE-ATTACK/Execution/README.md b/...s/MITRE-ATTACK/Lateral Movement/README.md → Playbooks/MITRE-ATTACK/Execution/README.md
diff --git a/Incident-Response-Roles/README.md → ...books/MITRE-ATTACK/Exfiltration/README.md b/Incident-Response-Roles/README.md → ...books/MITRE-ATTACK/Exfiltration/README.md
diff --git a/...s/MITRE-ATTACK/Impact/T1486-Ransomware.md → ...s/MITRE-ATTACK/Impact/T1486-Ransomware.md b/...s/MITRE-ATTACK/Impact/T1486-Ransomware.md → ...s/MITRE-ATTACK/Impact/T1486-Ransomware.md
diff --git a/...CK/Impact/T1491.002-Website-Defacement.md → ...CK/Impact/T1491.002-Website-Defacement.md b/...CK/Impact/T1491.002-Website-Defacement.md → ...CK/Impact/T1491.002-Website-Defacement.md
diff --git a/.../T1133-Unauthorized-VPN-and-VDI-Access.md → .../T1133-Unauthorized-VPN-and-VDI-Access.md b/.../T1133-Unauthorized-VPN-and-VDI-Access.md → .../T1133-Unauthorized-VPN-and-VDI-Access.md
diff --git a/...itial Access/T1189-Drive-By-Compromise.md → ...itial Access/T1189-Drive-By-Compromise.md b/...itial Access/T1189-Drive-By-Compromise.md → ...itial Access/T1189-Drive-By-Compromise.md
diff --git a/...E-ATTACK/Initial Access/T1566-Phishing.md → ...E-ATTACK/Initial Access/T1566-Phishing.md b/...E-ATTACK/Initial Access/T1566-Phishing.md → ...E-ATTACK/Initial Access/T1566-Phishing.md
diff --git a/Policy-Generation/README.md → ...s/MITRE-ATTACK/Lateral Movement/README.md b/Policy-Generation/README.md → ...s/MITRE-ATTACK/Lateral Movement/README.md
diff --git a/...TTACK/Persistence/T1505.003-Web-shells.md → ...TTACK/Persistence/T1505.003-Web-shells.md b/...TTACK/Persistence/T1505.003-Web-shells.md → ...TTACK/Persistence/T1505.003-Web-shells.md
diff --git a/...on/T1484.001-Group-Policy-Modification.md → ...on/T1484.001-Group-Policy-Modification.md b/...on/T1484.001-Group-Policy-Modification.md → ...on/T1484.001-Group-Policy-Modification.md
diff --git a/Incident-Response-Tools/README.md → Tools/README.md b/Incident-Response-Tools/README.md → Tools/README.md