// Map MITRE ATT&CK techniques to required data sources across Windows, Linux, cloud, network, and EDR telemetry. Includes CIM, ECS, Sigma, and KQL (Sentinel) field mapping comparisons.
Generate MITRE ATT&CK Navigator layers for coverage visualization, threat actor mapping, and gap analysis. Produces JSON files compatible with the Navigator web app.
Create grouped detection narratives that tie individual rules into coherent threat stories. Covers Splunk Analytic Stories, Elastic detection rule groups, and Sentinel analytics grouping.
Execute and validate adversary emulation tests using Atomic Red Team. Covers standard atomics, custom atomics (T9999.XXX), deployment workflows, and detection validation.
Build and manage adversary emulation lab environments for any SIEM. Covers Splunk Attack Range, Elastic Security labs, Azure Sentinel labs, and Docker-based setups. Maps data source requirements to infrastructure components.
Expert CTI analyst specializing in detection engineering, MITRE ATT&CK mapping, behavioral analysis, and intelligence-driven detection creation. SIEM-agnostic methodology that works with Splunk SPL, KQL, Sigma, and Elastic. Use when analyzing threat reports, creating detections, mapping MITRE techniques, or developing behavioral analytics.
Create, deploy, and execute custom Atomic Red Team tests (T9999.XXX series) for detection validation. Covers YAML authoring, Ansible deployment, and manual alternatives.
| name | Data Source Mapper |
| description | Map MITRE ATT&CK techniques to required data sources across Windows, Linux, cloud, network, and EDR telemetry. Includes CIM, ECS, Sigma, and KQL (Sentinel) field mapping comparisons. |
$SIEM_PLATFORM - Target SIEM: splunk, sentinel, elastic, sigma$SECURITY_CONTENT_PATH - Path to detection content repositoryEvery detection rule depends on specific telemetry. This skill maps ATT&CK techniques to the data sources that make detection possible, and compares field naming across common schemas (Splunk CIM, Elastic ECS, Sigma, and Sentinel/MDE).
| Data Source | Key Events | Detects | Collection Method |
|---|---|---|---|
| Windows Security Events | 4688 (Process), 4624/4625 (Logon), 4672 (Privileges) | Execution, Credential Access, Lateral Movement | Windows Event Forwarding, Splunk UF, Winlogbeat |
| Sysmon | 1 (Process), 3 (Network), 7 (Image Load), 11 (File Create), 13 (Registry) | Nearly all endpoint techniques | Sysmon + log forwarder |
| PowerShell Logging | 4104 (Script Block), 4103 (Module), 800/600 (Classic) | T1059.001, T1546.013, obfuscation | GPO: Script Block Logging |
| WMI Trace | WMI-Activity/Operational | T1047, T1546.003 | Built-in ETW provider |
| Windows Defender | 1116 (Detection), 1117 (Action) | Malware execution attempts | Windows Event Log |
| ETW Providers | Microsoft-Windows-DNS-Client, etc. | DNS, TLS, RPC activity | Custom ETW collection |
| Data Source | Key Events | Detects | Collection Method |
|---|---|---|---|
| auditd | SYSCALL, EXECVE, PATH, USER_AUTH | Execution, File Access, Auth | auditd rules + forwarder |
| syslog | auth.log, secure, messages | Authentication, sudo, cron | rsyslog/syslog-ng |
| journald | SystemD unit events | Service persistence, execution | journalctl export |
| osquery | Scheduled queries | File integrity, process, network | osquery daemon |
| eBPF | Process, file, network events | Fine-grained kernel telemetry | Cilium Tetragon, Tracee |
| Data Source | Key Events | Detects | Collection Method |
|---|---|---|---|
| AWS CloudTrail | API calls (Management + Data events) | IAM abuse, resource manipulation | S3 → log forwarder |
| AWS GuardDuty | Threat findings | Recon, credential compromise | EventBridge → SIEM |
| Azure Activity Log | ARM operations | Resource changes | Diagnostic Settings |
| Azure AD Sign-in Logs | Sign-in events, MFA | Credential abuse, brute force | Diagnostic Settings |
| GCP Audit Logs | Admin Activity, Data Access | IAM, resource access | Log Router → SIEM |
| O365 Unified Audit Log | Mail, SharePoint, Teams | BEC, data exfiltration | Management API |
| Data Source | Key Events | Detects | Collection Method |
|---|---|---|---|
| Zeek | conn.log, dns.log, http.log, ssl.log, files.log | C2, exfil, lateral movement | Network tap / span port |
| Suricata | alert, flow, dns, http, tls | Known signatures + protocol anomalies | Inline or passive |
| DNS Logs | Query/response | C2 over DNS, DGA | DNS server logs, passive DNS |
| Firewall Logs | Allow/deny, NAT | Lateral movement, exfil | Syslog from firewall |
| Proxy / WAF Logs | HTTP requests, URL categories | Web-based C2, initial access | Proxy log export |
| NetFlow / IPFIX | Flow records | Volume anomalies, beaconing | Router/switch export |
| Data Source | Key Events | Detects | Collection Method |
|---|---|---|---|
| CrowdStrike Falcon | ProcessRollup2, NetworkConnect, DnsRequest | Broad endpoint coverage | Falcon Data Replicator (FDR) |
| Microsoft Defender for Endpoint | DeviceProcessEvents, DeviceNetworkEvents | Broad endpoint coverage | Streaming API or Sentinel |
| SentinelOne | Process, File, Network telemetry | Broad endpoint coverage | API export |
| Carbon Black | Process, Netconn, Filemod | Broad endpoint coverage | Event Forwarder |
The same telemetry is named differently across schemas. This table maps common fields across all four platforms.
| Concept | Splunk CIM | Elastic ECS | Sigma (Generic) | Sentinel / MDE (KQL) |
|---|---|---|---|---|
| Process name | process_name | process.name | Image | FileName |
| Command line | process | process.command_line | CommandLine | ProcessCommandLine |
| Process ID | process_id | process.pid | ProcessId | ProcessId |
| Parent process name | parent_process_name | process.parent.name | ParentImage | InitiatingProcessFileName |
| Parent command line | parent_process | process.parent.command_line | ParentCommandLine | InitiatingProcessCommandLine |
| User | user | user.name | User | AccountName |
| Hostname | dest | host.name | Computer | DeviceName |
| File hash (SHA256) | process_hash | process.hash.sha256 | Hashes | SHA256 |
| Timestamp | _time | @timestamp | N/A | Timestamp |
| Concept | Splunk CIM | Elastic ECS | Sigma | Sentinel / MDE (KQL) |
|---|---|---|---|---|
| Source IP | src | source.ip | SourceIp | LocalIP |
| Destination IP | dest | destination.ip | DestinationIp | RemoteIP |
| Destination port | dest_port | destination.port | DestinationPort | RemotePort |
| Protocol | transport | network.transport | Protocol | Protocol |
| Bytes out | bytes_out | source.bytes | N/A | SentBytes |
| Application | app | network.application | N/A | N/A |
| Concept | Splunk CIM | Elastic ECS | Sigma | Sentinel / MDE (KQL) |
|---|---|---|---|---|
| File path | file_path | file.path | TargetFilename | FolderPath |
| File name | file_name | file.name | TargetFilename | FileName |
| File hash | file_hash | file.hash.sha256 | Hashes | SHA256 |
| Action | action | event.action | N/A | ActionType |
| Table | Data Source | Use For |
|---|---|---|
DeviceProcessEvents | MDE agent | Process creation and execution |
DeviceNetworkEvents | MDE agent | Network connections |
DeviceFileEvents | MDE agent | File creation, modification, deletion |
DeviceRegistryEvents | MDE agent | Registry modifications |
DeviceLogonEvents | MDE agent | Authentication events |
SecurityEvent | Azure Monitor Agent (legacy) | Windows Security Event Log |
Syslog | Azure Monitor Agent | Linux syslog |
SigninLogs | Azure AD connector | Azure AD authentication |
AuditLogs | Azure AD connector | Azure AD administrative changes |
| Technique | Required Data Source(s) | Minimum Viable |
|---|---|---|
| T1059.001 (PowerShell) | PowerShell 4104 + Sysmon 1 | PowerShell 4104 alone |
| T1059.003 (cmd.exe) | Sysmon 1 / Security 4688 | Security 4688 with cmd logging |
| T1003.001 (LSASS dump) | Sysmon 10 (ProcessAccess) | Sysmon 10 |
| T1053.005 (Sched. Task) | Security 4698/4702 + Sysmon 1 | Security 4698 |
| T1547.001 (Registry Run) | Sysmon 13 (Registry) | Sysmon 13 |
| T1021.001 (RDP) | Security 4624 Type 10 + Network | Security 4624 |
| T1071.001 (HTTP C2) | Zeek http.log / Proxy logs | Proxy logs |
| T1078.004 (Cloud Accounts) | Azure AD / CloudTrail | Cloud auth logs |
If you lack a data source, you lack detection capability for techniques that depend on it. Use this mapping to:
Use the data source mapping to determine what infrastructure your test lab needs. See the Test Environment Builder skill for building labs that produce specific data sources.