Using MITRE CAR

The data model implemented by MITRE CAR or MITRE Cyber Analytics Repository (https://car.mitre.org/), was inspired in STIX’s Cyber Observable eXpression (CybOX ™), and is an “organization of objects that may be monitored from a host-based or network-based perspective”. Each of the objects is defined by the actions that can happen to it and the observable properties, called fields, which can be captured by a sensor.

So, for example, CAR data model for a file looks like the following:

Figure 5.4 – MITRE CAR File Data Model Example

To put it mildly, CAR intent is to record how to detect threats based on the ATT&CK Framework. So, every analytic (https://car.mitre.org/analytics/) provided by CAR references the ATT&CK tactics and techniques that detects accompanied by the hypothesis behind the analytics.

But probably, the most interesting thing about MITRE CAR is that it provides a list of possible detection implementations that you...