# queries

name: Playbook - Community Sigma
column_names:
  ---
  - :status
  - :cf_24
  - :cf_25
  - :cf_6
  - :updated_on

sort_criteria:
  ---
  - - id
  - desc

type: IssueQuery
options:
  ---
  :totalable_names: []
  :draw_relations:
  :draw_progress_line:

filters:
  ---
  cf_24:
    :operator: "="
    :values:
    - comm-win-sysmon
    - comm-win-builtin
    - comm-win-proc
    - comm-win-malware
    - comm-win-other
    - comm-win-powershell
  tracker_id:
    :operator: "="
    :values:
    - '4'


name: Playbook - Internal
column_names:
  ---
  - :status
  - :cf_23
  - :cf_24
  - :cf_25
  - :cf_27
  - :cf_6
  - :updated_on

sort_criteria:
  ---
  - - id
  - desc

type: IssueQuery
options:
  ---
  :totalable_names: []
  :draw_relations:
  :draw_progress_line:

filters:
  ---
  tracker_id:
    :operator: "="
    :values:
    - '4'
  cf_24:
    :operator: "="
    :values:
    - Internal


# documents

title: test
created_on: 2019-08-25 13:41:58.688580
description:
  ``` yaml
  alert:
  - debug
  description: Detects PowerShell called from an executable by the version mismatch
    method
  filter:
  - query:
      query_string:
        query: (event_id:"400" AND event_data.EngineVersion.keyword:(2.* 4.* 5.*) AND
          event_data.HostVersion.keyword:3.*)
  index: logstash-beats-*
  name: PowerShell-called-from-an-Executable-Version-Mismatch_0
  priority: 2
  realert:
    minutes: 0
  type: any
  ```


title: Webhook?
created_on: 2019-08-26 18:43:07.873301
description:
  title: Clear Command History
  status: experimental
  description: Clear command history in linux which is used for defense evasion. 
  references:
      - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1146/T1146.yaml
      - https://attack.mitre.org/techniques/T1146/
  author: Patrick Bareiss
  date: 2019/03/24
  logsource:
      product: linux
  detection:
      keywords:
          - 'rm *bash_history'
          - 'echo "" > *bash_history'
          - 'cat /dev/null > *bash_history' 
          - 'ln -sf /dev/null *bash_history'
          - 'truncate -s0 *bash_history'
          # - 'unset HISTFILE'  # prone to false positives
          - 'export HISTFILESIZE=0'
          - 'history -c'
      condition: keywords
  falsepositives:
      - Unknown
  level: high
  tags:
      - attack.defense_evasion
      - attack.t1146


# custom_fields

type: IssueCustomField
name: Objective
field_format: text
format_store:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  text_formatting: full
  full_width_layout: '1'


type: IssueCustomField
name: Order
field_format: list
format_store:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  url_pattern: ''
  edit_tag_style: ''

possible_values:
  ---
  - '1'
  - '2'
  - '3'
  - '4'
  - '5'
  - '6'
  - '7'
  - '8'
  - '9'
  - '10'
  - '11'
  - '12'
  - '13'
  - '14'
  - '15'


type: IssueCustomField
name: References
field_format: text
format_store:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  text_formatting: full
  full_width_layout: '0'


type: IssueCustomField
name: Playbook
field_format: list
default_value: External
format_store:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  url_pattern: ''
  edit_tag_style: ''

possible_values:
  ---
  - External
  - Internal
  - comm-win-sysmon
  - comm-win-builtin
  - comm-win-proc
  - comm-win-malware
  - comm-win-other
  - comm-win-powershell


type: IssueCustomField
name: ATT&CK Technique
field_format: list
possible_values:
  ---
  - T1001
  - T1002
  - T1003
  - T1004
  - T1005
  - T1006
  - T1007
  - T1008
  - T1009
  - T1010
  - T1011
  - T1012
  - T1013
  - T1014
  - T1015
  - T1016
  - T1017
  - T1018
  - T1019
  - T1020
  - T1021
  - T1022
  - T1023
  - T1024
  - T1025
  - T1026
  - T1027
  - T1028
  - T1029
  - T1030
  - T1031
  - T1032
  - T1033
  - T1034
  - T1035
  - T1036
  - T1037
  - T1038
  - T1039
  - T1040
  - T1041
  - T1042
  - T1043
  - T1044
  - T1045
  - T1046
  - T1047
  - T1048
  - T1049
  - T1050
  - T1051
  - T1052
  - T1053
  - T1054
  - T1055
  - T1056
  - T1057
  - T1058
  - T1059
  - T1060
  - T1061
  - T1062
  - T1063
  - T1064
  - T1065
  - T1066
  - T1067
  - T1068
  - T1069
  - T1070
  - T1071
  - T1072
  - T1073
  - T1074
  - T1075
  - T1076
  - T1077
  - T1078
  - T1079
  - T1080
  - T1081
  - T1082
  - T1083
  - T1084
  - T1085
  - T1086
  - T1087
  - T1088
  - T1089
  - T1090
  - T1091
  - T1092
  - T1093
  - T1094
  - T1095
  - T1096
  - T1097
  - T1098
  - T1099
  - T1100
  - T1101
  - T1102
  - T1103
  - T1104
  - T1105
  - T1106
  - T1107
  - T1108
  - T1109
  - T1110
  - T1111
  - T1112
  - T1113
  - T1114
  - T1115
  - T1116
  - T1117
  - T1118
  - T1119
  - T1120
  - T1121
  - T1122
  - T1123
  - T1124
  - T1125
  - T1126
  - T1127
  - T1128
  - T1129
  - T1130
  - T1131
  - T1132
  - T1133
  - T1134
  - T1135
  - T1136
  - T1137
  - T1138
  - T1139
  - T1140
  - T1141
  - T1142
  - T1143
  - T1144
  - T1145
  - T1146
  - T1147
  - T1148
  - T1149
  - T1150
  - T1151
  - T1152
  - T1153
  - T1154
  - T1155
  - T1156
  - T1157
  - T1158
  - T1159
  - T1160
  - T1161
  - T1162
  - T1163
  - T1164
  - T1165
  - T1166
  - T1167
  - T1168
  - T1169
  - T1170
  - T1171
  - T1172
  - T1173
  - T1174
  - T1175
  - T1176
  - T1177
  - T1178
  - T1179
  - T1180
  - T1181
  - T1182
  - T1183
  - T1184
  - T1185
  - T1186
  - T1187
  - T1188
  - T1189
  - T1190
  - T1191
  - T1192
  - T1193
  - T1194
  - T1195
  - T1196
  - T1197
  - T1198
  - T1199
  - T1200
  - T1201
  - T1202
  - T1203
  - T1204
  - T1205
  - T1206
  - T1207
  - T1208
  - T1209
  - T1210
  - T1211
  - T1212
  - T1213
  - T1214
  - T1215
  - T1216
  - T1217
  - T1218
  - T1219
  - T1220
  - T1221
  - T1222
  - T1223
  - T1224
  - T1225
  - T1226
  - T1227
  - T1228
  - T1229
  - T1230
  - T1231
  - T1232
  - T1233
  - T1234
  - T1235
  - T1236
  - T1237
  - T1238
  - T1239
  - T1240
  - T1241
  - T1242
  - T1243
  - T1244
  - T1245
  - T1246
  - T1247
  - T1248
  - T1249
  - T1250
  - T1251
  - T1252
  - T1253
  - T1254
  - T1255
  - T1256
  - T1257
  - T1258
  - T1259
  - T1260
  - T1261
  - T1262
  - T1263
  - T1264
  - T1265
  - T1266
  - T1267
  - T1268
  - T1269
  - T1270
  - T1271
  - T1272
  - T1273
  - T1274
  - T1275
  - T1276
  - T1277
  - T1278
  - T1279
  - T1280
  - T1281
  - T1282
  - T1283
  - T1284
  - T1285
  - T1286
  - T1287
  - T1288
  - T1289
  - T1290
  - T1291
  - T1292
  - T1293
  - T1294
  - T1295
  - T1296
  - T1297
  - T1298
  - T1299
  - T1300
  - T1301
  - T1302
  - T1303
  - T1304
  - T1305
  - T1306
  - T1307
  - T1308
  - T1309
  - T1310
  - T1311
  - T1312
  - T1313
  - T1314
  - T1315
  - T1316
  - T1317
  - T1318
  - T1319
  - T1320
  - T1321
  - T1322
  - T1323
  - T1324
  - T1325
  - T1326
  - T1327
  - T1328
  - T1329
  - T1330
  - T1331
  - T1332
  - T1333
  - T1334
  - T1335
  - T1336
  - T1337
  - T1338
  - T1339
  - T1340
  - T1341
  - T1342
  - T1343
  - T1344
  - T1345
  - T1346
  - T1347
  - T1348
  - T1349
  - T1350
  - T1351
  - T1352
  - T1353
  - T1354
  - T1355
  - T1356
  - T1357
  - T1358
  - T1359
  - T1360
  - T1361
  - T1362
  - T1363
  - T1364
  - T1365
  - T1366
  - T1367
  - T1368
  - T1369
  - T1370
  - T1371
  - T1372
  - T1373
  - T1374
  - T1375
  - T1376
  - T1377
  - T1378
  - T1379
  - T1380
  - T1381
  - T1382
  - T1383
  - T1384
  - T1385
  - T1386
  - T1387
  - T1388
  - T1389
  - T1390
  - T1391
  - T1392
  - T1393
  - T1394
  - T1395
  - T1396
  - T1397
  - T1398
  - T1399
  - T1400
  - T1401
  - T1402
  - T1403
  - T1404
  - T1405
  - T1406
  - T1407
  - T1408
  - T1409
  - T1410
  - T1411
  - T1412
  - T1413
  - T1414
  - T1415
  - T1416
  - T1417
  - T1418
  - T1419
  - T1420
  - T1421
  - T1422
  - T1423
  - T1424
  - T1425
  - T1426
  - T1427
  - T1428
  - T1429
  - T1430
  - T1431
  - T1432
  - T1433
  - T1434
  - T1435
  - T1436
  - T1437
  - T1438
  - T1439
  - T1440
  - T1441
  - T1442
  - T1443
  - T1444
  - T1445
  - T1446
  - T1447
  - T1448
  - T1449
  - T1450
  - T1451
  - T1452
  - T1453
  - T1454
  - T1455
  - T1456
  - T1457
  - T1458
  - T1459
  - T1460
  - T1461
  - T1462
  - T1463
  - T1464
  - T1465
  - T1466
  - T1467
  - T1468
  - T1469
  - T1470
  - T1471
  - T1472
  - T1473
  - T1474
  - T1475
  - T1476
  - T1477
  - T1478
  - T1479
  - T1480
  - T1481
  - T1482
  - T1483
  - T1484
  - T1485
  - T1486
  - T1487
  - T1488
  - T1489
  - T1490
  - T1491
  - T1492
  - T1493
  - T1494
  - T1495
  - T1496
  - T1497
  - T1498
  - T1499
  - T1500
  - T1501
  - T1502
  - T1503
  - T1504
  - T1505
  - T1506
  - T1507
  - T1508
  - T1509
  - T1510
  - T1511
  - T1512
  - T1513
  - T1514
  - T1515
  - T1516
  - T1517
  - T1518
  - T1519
  - T1520
  - T1521
  - T1522
  - T1523
  - T1524
  - T1525
  - T1526
  - T1527
  - T1528
  - T1529
  - T1530
  - T1531
  - T1532
  - T1533
  - T1534
  - T1535
  - T1536
  - T1537
  - T1538
  - T1539
  - T1540
  - T1541
  - T1542
  - T1543
  - T1544
  - T1545
  - T1546
  - T1547
  - T1548
  - T1549
  - T1550
  - T1551
  - T1552
  - T1553

format_store:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  url_pattern: https://attack.mitre.org/techniques/%value%
  edit_tag_style: ''


# imports

type: IssueImport
filename: c32da363ebee1050517ca61125f96878
created_at: 2019-06-28 20:39:19.990976
updated_at: 2019-06-28 20:40:07.491869
settings:
  ---
  separator: ","
  wrapper: "\""
  encoding: ISO-8859-1
  date_format: "%m/%d/%Y"
  mapping: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    project_id: '1'
    tracker: '2'
    status: '4'
    subject: '6'
    description: ''
    priority: ''
    category: ''
    assigned_to: ''
    fixed_version: ''
    cf_1: ''
    cf_6: ''
    cf_2: ''
    cf_7: ''
    cf_3: ''
    cf_5: ''
    cf_4: ''
    cf_8: ''
    cf_9: ''
    cf_10: ''
    cf_11: ''
    cf_12: ''
    cf_14: ''
    is_private: ''
    parent_issue_id: ''
    start_date: ''
    due_date: ''
    estimated_hours: ''
    done_ratio: ''


type: IssueImport
filename: 96833c42a8e490907fac465dc55d80b6
created_at: 2019-06-28 20:40:36.340614
updated_at: 2019-06-28 20:41:01.781417
settings:
  ---
  separator: ","
  wrapper: "\""
  encoding: ISO-8859-1
  date_format: "%m/%d/%Y"
  mapping: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    project_id: '1'
    tracker: '2'
    status: ''
    subject: '6'
    description: ''
    priority: ''
    category: ''
    assigned_to: ''
    fixed_version: ''
    cf_1: '15'
    cf_6: '16'
    cf_2: ''
    cf_7: ''
    cf_3: ''
    cf_5: ''
    cf_4: ''
    cf_8: ''
    cf_9: ''
    cf_10: ''
    cf_11: ''
    cf_12: ''
    cf_14: ''
    is_private: ''
    parent_issue_id: ''
    start_date: ''
    due_date: ''
    estimated_hours: ''
    done_ratio: ''


# roles

name: Non member
issues_visibility: default
users_visibility: all
time_entries_visibility: all
permissions:
  ---
  - :view_issues
  - :add_issues
  - :add_issue_notes
  - :save_queries
  - :view_gantt
  - :view_calendar
  - :view_time_entries
  - :view_news
  - :comment_news
  - :view_documents
  - :view_wiki_pages
  - :view_wiki_edits
  - :view_messages
  - :add_messages
  - :view_files
  - :browse_repository
  - :view_changesets


name: Anonymous
issues_visibility: default
users_visibility: all
time_entries_visibility: all
permissions:
  ---
  - :view_messages
  - :view_calendar
  - :view_documents
  - :view_files
  - :view_gantt
  - :view_news
  - :view_changesets
  - :browse_repository
  - :view_time_entries
  - :view_wiki_edits

settings:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  permissions_all_trackers: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: '0'
    add_issues: '1'
    edit_issues: '1'
    add_issue_notes: '1'
    delete_issues: '0'
  permissions_tracker_ids: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: []
    add_issues: []
    edit_issues: []
    add_issue_notes: []
    delete_issues: []


name: SuperAdmin
issues_visibility: all
users_visibility: all
time_entries_visibility: all
permissions:
  ---
  - :add_project
  - :edit_project
  - :close_project
  - :select_project_modules
  - :manage_members
  - :manage_versions
  - :add_subprojects
  - :manage_public_queries
  - :save_queries
  - :manage_hook
  - :view_messages
  - :add_messages
  - :edit_messages
  - :edit_own_messages
  - :delete_messages
  - :delete_own_messages
  - :manage_boards
  - :view_calendar
  - :view_documents
  - :add_documents
  - :edit_documents
  - :delete_documents
  - :view_files
  - :manage_files
  - :view_gantt
  - :view_issues
  - :add_issues
  - :edit_issues
  - :copy_issues
  - :manage_issue_relations
  - :manage_subtasks
  - :set_issues_private
  - :set_own_issues_private
  - :add_issue_notes
  - :edit_issue_notes
  - :edit_own_issue_notes
  - :view_private_notes
  - :set_notes_private
  - :delete_issues
  - :view_issue_watchers
  - :add_issue_watchers
  - :delete_issue_watchers
  - :import_issues
  - :manage_categories
  - :view_news
  - :manage_news
  - :comment_news
  - :view_changesets
  - :browse_repository
  - :commit_access
  - :manage_related_issues
  - :manage_repository
  - :view_time_entries
  - :log_time
  - :edit_time_entries
  - :edit_own_time_entries
  - :manage_project_activities
  - :view_wiki_pages
  - :view_wiki_edits
  - :export_wiki_pages
  - :edit_wiki_pages
  - :rename_wiki_pages
  - :delete_wiki_pages
  - :delete_wiki_pages_attachments
  - :protect_wiki_pages
  - :manage_wiki

settings:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  permissions_all_trackers: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: '1'
    add_issues: '1'
    edit_issues: '1'
    add_issue_notes: '1'
    delete_issues: '1'
  permissions_tracker_ids: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: []
    add_issues: []
    edit_issues: []
    add_issue_notes: []
    delete_issues: []


name: Security-Analyst
issues_visibility: default
users_visibility: all
time_entries_visibility: all
permissions:
  ---
  - :save_queries
  - :view_issues
  - :add_issues
  - :edit_issues
  - :copy_issues
  - :add_issue_notes
  - :view_private_notes

settings:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  permissions_all_trackers: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: '1'
    add_issues: '0'
    edit_issues: '1'
    add_issue_notes: '1'
    delete_issues: '1'
  permissions_tracker_ids: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    add_issues:
    - '6'
    view_issues: []
    edit_issues: []
    add_issue_notes: []
    delete_issues: []


name: Admin
issues_visibility: all
users_visibility: all
time_entries_visibility: all
permissions:
  ---
  - :add_project
  - :edit_project
  - :close_project
  - :select_project_modules
  - :manage_members
  - :manage_versions
  - :add_subprojects
  - :manage_public_queries
  - :save_queries
  - :view_messages
  - :add_messages
  - :edit_messages
  - :edit_own_messages
  - :delete_messages
  - :delete_own_messages
  - :manage_boards
  - :view_calendar
  - :view_documents
  - :add_documents
  - :edit_documents
  - :delete_documents
  - :view_files
  - :manage_files
  - :view_gantt
  - :view_issues
  - :add_issues
  - :edit_issues
  - :copy_issues
  - :manage_issue_relations
  - :set_issues_private
  - :set_own_issues_private
  - :add_issue_notes
  - :edit_issue_notes
  - :edit_own_issue_notes
  - :view_private_notes
  - :set_notes_private
  - :delete_issues
  - :view_issue_watchers
  - :add_issue_watchers
  - :delete_issue_watchers
  - :import_issues
  - :manage_categories
  - :view_news
  - :manage_news
  - :comment_news
  - :view_changesets
  - :browse_repository
  - :commit_access
  - :manage_related_issues
  - :manage_repository
  - :view_time_entries
  - :log_time
  - :edit_time_entries
  - :edit_own_time_entries
  - :manage_project_activities
  - :view_wiki_pages
  - :view_wiki_edits
  - :export_wiki_pages
  - :edit_wiki_pages
  - :rename_wiki_pages
  - :delete_wiki_pages
  - :delete_wiki_pages_attachments
  - :protect_wiki_pages
  - :manage_wiki

settings:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  permissions_all_trackers: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: '1'
    add_issues: '1'
    edit_issues: '1'
    add_issue_notes: '1'
    delete_issues: '1'
  permissions_tracker_ids: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: []
    add_issues: []
    edit_issues: []
    add_issue_notes: []
    delete_issues: []


name: Automation
issues_visibility: default
users_visibility: all
time_entries_visibility: all
permissions:
  ---
  - :save_queries
  - :view_issues
  - :add_issues
  - :edit_issues
  - :copy_issues
  - :add_issue_notes
  - :edit_issue_notes
  - :edit_own_issue_notes
  - :view_private_notes
  - :import_issues
  - :manage_categories

settings:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  permissions_all_trackers: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: '1'
    add_issues: '1'
    edit_issues: '1'
    add_issue_notes: '1'
    delete_issues: '1'
  permissions_tracker_ids: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: []
    add_issues: []
    edit_issues: []
    add_issue_notes: []
    delete_issues: []


# user_preferences

others:
  ---
  :no_self_notified: '1'
  :my_page_layout:
    left: []
    right: []
  :my_page_settings: {}
  :gantt_zoom: 2
  :gantt_months: 6
  :comments_sorting: asc
  :warn_on_leaving_unsaved: '1'
  :textarea_font: ''


others:
  ---
  :no_self_notified: '1'
  :comments_sorting: asc
  :warn_on_leaving_unsaved: '1'
  :textarea_font: ''
  :my_page_layout:
    left:
    - issuesassignedtome
    right:
    - issuesreportedbyme
  :my_page_settings: {}


