Skip to main content

Making edits to SCRIPTS

note

Prior to pulling the most recent version from, or commiting edits to the SCRIPTS repo on the DIP, you will need to have completed the Initial Setup of the MIP with the DIP hosted Gitlab.

Script Folder Labeling Standard​

info

Folder Label Format​

Full Label Format: <UNIT>-<SHORT_TITLE>-<TYPE>-<SERIES>
Example 1: 262COS-Sigma_To_Detection_Rule_Converter-SCRIPT-001

NOTE: This example title signifies that the folder contains one or more standalone scripts that might have to do with converting Sigma rules to Elastic Detection Rules, and was developed by the 262COS.

Example 2: 262COS-Metasponse_Plugins-PACKAGE-001

  • This example title signifies that the folder contains one or more standalone scripts that might have to do with converting Sigma rules to Elastic Detection Rules, and was developed by the 262COS.

Label Breakdown​

  • <UNIT>: This identifies the unit that the capability was developed by.

  • <SHORT_TITLE>: A brief title descriptive enough to inform what the capability does.
    Example: ATT&CK_Navigator_Layer_Creator

    • This is a string to identify the purpose of the capability.
    • Replace would-be spaces with underscores (_) to make it easier to navigate the filestructure in a command-line environment.
    • It is preferable to be kept short in order to avoid long filenames.

  • <TYPE>: This identifies the type of content expected to be inside the parent folder of the capability.

    TypeDefinition
    SCRIPTOne or more standalone script/executable files that have no dependancy on each other to fulfill the capabilities intended purpose(s), if there are more than one file. EXAMPLES: A series of host artifact collection scripts, or the Sysinternals suite.
    PACKAGEA combination of script/executable/configuration files that depend on each other, or need to be used together in a certain order to fulfill the capabilities intended purpose(s). EXAMPLES: A "contrib" folder filled with scripts/executables to be imported into Metasponse as custom plugins
    CONFIGOne or more configuration files that are meant to augment the functionality of a tool/system to perform in a certain way. EXAMPLE: Sysmon configs, Auditbeat rules, database exports (of configuration settings)

  • <SERIES>: This is an iterating number starting from 001 that signifies numbered capability of the same SHORT_TITLE and TYPE, and from the same UNIT. This is used to differentiate between the same-ish capabilities developed by different members, such as the many "host agent deployment" scripts out there.

1. Create your own working branch​

  1. Change directories to the /cvah/git/SCRIPTS project folder:

    cd /cvah/git/SCRIPTS

  2. Ensure the remote named origin is pointing to the DIP Gitlab instance at https://gitlab/262-cos/SCRIPTS

    git remote -v
    tip

    If origin is not pointing to the correct location, you can change it with the following command:

    git remote set-url origin https://gitlab/262-cos/SCRIPTS

  3. Pull the most recent changes of the main branch from the DIP Gitlab instance to your local repo:

    git pull

    NOTE: You can skip this step if you do not have a connection to the DIP Gitlab.

  4. Create a new branch of the current snapshot of the main branch with name containing your username, then use checkout to switch to it:

    git branch <YOUR_USERNAME>-edits
    git checkout <YOUR_USERNAME>-edits

  5. Publish your new branch to the DIP Gitlab:

    git push --set-upstream origin <YOUR_USERNAME>-edits

    NOTE: You can skip this step if you do not have a connection to the DIP Gitlab.

2. Making changes in VS Code​

  1. Start VS Code and open the local SCRIPTS repository:

    code /cvah/git/SCRIPTS

    NOTE: You may be prompted to Trust the authors of all files in the parent folder 'git' - check the box and click Yes

  2. Work on the repository as you see fit, using the VS Code Fundamentals page as a reference