Develop YAML format for Sensor Coverage

[Ivan Kirillov]

We should develop a YAML format for capturing our sensor coverage, so it doesn't have to be done in MD/HTML.

[Ivan Kirillov]

Here's a first stab. Maybe a little too much nesting, but I was going mostly for simplicity:

---
sensor_name: Foo
sensor_version: 1.3.2
sensor_developer: ACME Soft.
sensor_url: http://acme/foo/1.3.2
coverage:
  file:
    create:
      notes: 'sha1_hash is provided only if the tool is configured to do so.'
      fields: 
        - file_name
        - file_path
        - md5_hash
        - sha1_hash
    delete:
      fields: 
        - file_name
        - file_path
        - md5_hash
        - sha1_hash
  driver:
    load: none
    unload: none
  flow:
    start: none
  module:
    load: none
  process:
    create: none
  registry:
    add: none
  service:
    create: none
  thread:
    create: none
  user_session:
    local: none

[Ivan Kirillov]

The "final" YAML format can be seen in the Sysmon 10.4 mappings: https://github.com/mitre-attack/car/blob/master/docs/sensors/sysmon_10.4.yaml

It has changed slightly from the above, as I found using a list-based approach made it much easier to parse.