The best way to view the analytics in this repository is via the CAR website.
This repository is the way to contribute new analytics, data model changes, or sensor changes. Analytics contributed in this repo are automatically published in CAR.
Right now, all content in CAR is in the docs folder. This is because the car.mitre.org website is built from there. In the future, we hope to have structured content to represent the analytics, data model, and sensors that would then generate the website content. Please let us know if you're interested in helping out with that aspect!
In the meantime, here's how to find the source for our content. Within docs:
- analytics: Contains the full list of analytics
- data_model: Contains the data model pages
- sensors: Contains the sensor pages
The other directories in docs are used to build the website and you shouldn't need to worry about them.
The implementations directory contains libraries of analytics that are best represented as source code for specific tools. As an example, BZAR (Bro/Zeek ATT&CK-Based Analytics and Reporting) is a library of source code for Zeek (previously Bro).
- Read CONTRIBUTING.md to better understand what we're looking for. There's also a Developer Certificate of Origin that you'll need to sign off on.
- Open an issue. There are issue templates for adding an analytic, adding to the data model, and adding a new sensor mapping. If you have other changes, feel free to open a generic issue.
- Wait for feedback on your issue. We may ask you for more information, or see what others in the community think. Once the issue is accepted and the change made, car.mitre.org will be automatically updated with your new content.