renaming data yml files

Author: Patrick Bareiss

bin/rename_data.py

@@ -9,22 +9,27 @@ description: 'Atomic Test Results: Successful Execution of test T1003.001-1 Wind
   Offline Credential Theft With Mimikatz Return value unclear for test T1003.001-7
   LSASS read with pypykatz '
 environment: attack_range
-dataset:
-- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-powershell.log
-- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log
-- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
-- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/createdump_windows-sysmon.log
-- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon_creddump.log
-- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-system.log
-- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon.log
-- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/procdump_windows-security.log
-sourcetypes:
-- XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-- WinEventLog:Microsoft-Windows-PowerShell/Operational
-- WinEventLog:System
-- WinEventLog:Security
-- crowdstrike:events:sensor
-references:
-- https://attack.mitre.org/techniques/T1003/001/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md
-- https://github.com/splunk/security-content/blob/develop/tests/T1003_001.yml
+directory: atomic_red_team
+mitre_technique:
+- T1003.001
+datasets:
+- name: windows-sysmon_creddump
+  path: /datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon_creddump.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+- name: procdump_windows-security
+  path: /datasets/attack_techniques/T1003.001/atomic_red_team/procdump_windows-security.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Security
+- name: crowdstrike_falcon
+  path: /datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon.log
+  sourcetype: crowdstrike:events:sensor
+  source: crowdstrike
+- name: createdump_windows-sysmon
+  path: /datasets/attack_techniques/T1003.001/atomic_red_team/createdump_windows-sysmon.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+- name: windows-sysmon
+  path: /datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational