HomeData Sources

Data Sources

Sources of information that can be used to detect adversary techniques

38 Data Sources107 Data Components

Data Sources Overview

Total Data Sources38

Total Components107

About Data Sources

Data sources represent the various subjects/topics of information that can be collected by sensors/logs. Data sources also include data components, which identify specific properties/values of a data source relevant to detecting a given ATT&CK technique or sub-technique.

Endpoint data sources monitor host activities

Network data sources capture traffic patterns

Cloud data sources track cloud service events

Data Sources

DS0015Application LogEvents collected by third-party services such as mail servers, web applications, or other appliances.1 components•11 techniques

Application Log

DS0026Active DirectoryA database and set of services that allows administrators to manage permissions, access to network resources, and stored data objects.5 components•7 techniques

Active Directory

DS0027DriverA computer program that operates or controls a particular type of device that is attached to a computer.1 components•5 techniques

Driver

DS0028Logon SessionLogon occurring on a system or resource to which a user/device is gaining access after successful authentication.2 components•6 techniques

Logon Session

DS0029Network TrafficData transmitted across a network, captured as either content or metadata.3 components•20 techniques

Network Traffic

DS0009ProcessInstances of computer programs that are being executed by at least one thread.6 components•21 techniques

Process

DS0022FileA computer resource object, managed by the I/O system, for storing data.5 components•27 techniques

File

DS0024Windows RegistryA Windows OS hierarchical database that stores configuration settings and options.4 components•7 techniques

Windows Registry

DS0017CommandA directive to a computer program to perform a specific task.1 components•12 techniques

Command

DS0019ServiceA computer program that is run as a background process.3 components•5 techniques

Service

DS0002User AccountA profile for a user that is associated with a username, password, and permissions group.5 components•7 techniques

User Account

DS0006Web CredentialCredential material that grants access to web applications or services.2 components•5 techniques

Web Credential

DS0030InstanceA virtual server environment which runs workloads, hosted on-premise or by third-party cloud providers.6 components•4 techniques

Instance

DS0025Cloud ServiceInfrastructure, platforms, or software that are hosted on-premise or by third-party providers.4 components•5 techniques

Cloud Service

DS0032ContainerA standard unit of software that packages up code and all its dependencies.4 components•5 techniques

Container

DS0016DriveA non-volatile data storage device that reads/writes to a magnetic disk, flash memory, or optical disc.3 components•7 techniques

Drive

DS0013Sensor HealthInformation from host telemetry providing insights on operational status of sensors or agents running on the system.1 components•2 techniques

Sensor Health

DS0014PodA single unit of shared resources within a cluster.4 components•4 techniques

Pod

DS0012ScriptA file or stream containing a list of commands, allowing them to be launched in sequence.1 components•4 techniques

Script

DS0018FirewallA network security system that monitors and controls incoming and outgoing network traffic.4 components•1 techniques

Firewall

DS0007ImageA single file used to deploy a virtual machine/container.4 components•5 techniques

Image

DS0033Network ShareA storage resource made available from one host to other hosts on a network.1 components•5 techniques

Network Share

DS0011ModuleExecutable files consisting of one or more shared libraries that are loaded into a process.1 components•4 techniques

Module

DS0020SnapshotA point-in-time copy of cloud volumes.5 components•1 techniques

Snapshot

DS0034VolumeBlock-based cloud storage that can be attached to instances.5 components•1 techniques

Volume

DS0001FirmwareComputer software that provides low-level control for a device's hardware.1 components•3 techniques

Firmware

DS0010Cloud StorageData object storage infrastructure hosted on-premise or by third-party providers.6 components•3 techniques

Cloud Storage

DS0031ClusterA set of containerized computing resources that are managed together.1 components•4 techniques

Cluster

DS0008KernelThe central component of an operating system that manages operations of computer hardware and software resources.1 components•3 techniques

Kernel

DS0003Scheduled JobAutomated tasks that can be executed at a specific time or on a recurring schedule.3 components•1 techniques

Scheduled Job

DS0023Named PipeA named section of shared memory used for inter-process communication.1 components•2 techniques

Named Pipe

DS0004Malware RepositoryInformation about malware samples and their associated metadata.2 components•2 techniques

Malware Repository

DS0021PersonaA malicious online identity created by adversaries to support operations.1 components•2 techniques

Persona

DS0035Internet ScanInformation gathered from scanning the internet for hosts and services.2 components•2 techniques

Internet Scan

DS0036GroupA collection of users or computers that share common access permissions.3 components•2 techniques

Group

DS0037CertificateA digital document that certifies the ownership of a public key.1 components•2 techniques

Certificate

DS0038Domain NameInformation about domain names and their registration.3 components•3 techniques

Domain Name

DS0039WMIWindows Management Instrumentation infrastructure for managing data and operations.1 components•3 techniques

WMI

Data Sources Overview

About Data Sources