1---2name: data-source-mapper3description: Map MITRE ATT&CK techniques to required data sources across Windows, Linux, cloud, network, and EDR telemetry. Includes CIM, ECS, Sigma, and KQL (Sentinel) field mapping comparisons.4---56# Data Source Mapper Skill78## Configuration910- `$SIEM_PLATFORM` - Target SIEM: `splunk`, `sentinel`, `elastic`, `sigma`11- `$SECURITY_CONTENT_PATH` - Path to detection content repository1213## Overview1415Every detection rule depends on specific telemetry. This skill maps ATT&CK techniques to the data sources that make detection possible, and compares field naming across common schemas (Splunk CIM, Elastic ECS, Sigma, and Sentinel/MDE).1617## Data Source Catalog1819### Windows Endpoint2021| Data Source | Key Events | Detects | Collection Method |22|-------------|-----------|---------|-------------------|23| **Windows Security Events** | 4688 (Process), 4624/4625 (Logon), 4672 (Privileges) | Execution, Credential Access, Lateral Movement | Windows Event Forwarding, Splunk UF, Winlogbeat |24| **Sysmon** | 1 (Process), 3 (Network), 7 (Image Load), 11 (File Create), 13 (Registry) | Nearly all endpoint techniques | Sysmon + log forwarder |25| **PowerShell Logging** | 4104 (Script Block), 4103 (Module), 800/600 (Classic) | T1059.001, T1546.013, obfuscation | GPO: Script Block Logging |26| **WMI Trace** | WMI-Activity/Operational | T1047, T1546.003 | Built-in ETW provider |27| **Windows Defender** | 1116 (Detection), 1117 (Action) | Malware execution attempts | Windows Event Log |28| **ETW Providers** | Microsoft-Windows-DNS-Client, etc. | DNS, TLS, RPC activity | Custom ETW collection |2930### Linux Endpoint3132| Data Source | Key Events | Detects | Collection Method |33|-------------|-----------|---------|-------------------|34| **auditd** | SYSCALL, EXECVE, PATH, USER_AUTH | Execution, File Access, Auth | auditd rules + forwarder |35| **syslog** | auth.log, secure, messages | Authentication, sudo, cron | rsyslog/syslog-ng |36| **journald** | SystemD unit events | Service persistence, execution | journalctl export |37| **osquery** | Scheduled queries | File integrity, process, network | osquery daemon |38| **eBPF** | Process, file, network events | Fine-grained kernel telemetry | Cilium Tetragon, Tracee |3940### Cloud4142| Data Source | Key Events | Detects | Collection Method |43|-------------|-----------|---------|-------------------|44| **AWS CloudTrail** | API calls (Management + Data events) | IAM abuse, resource manipulation | S3 → log forwarder |45| **AWS GuardDuty** | Threat findings | Recon, credential compromise | EventBridge → SIEM |46| **Azure Activity Log** | ARM operations | Resource changes | Diagnostic Settings |47| **Azure AD Sign-in Logs** | Sign-in events, MFA | Credential abuse, brute force | Diagnostic Settings |48| **GCP Audit Logs** | Admin Activity, Data Access | IAM, resource access | Log Router → SIEM |49| **O365 Unified Audit Log** | Mail, SharePoint, Teams | BEC, data exfiltration | Management API |5051### Network5253| Data Source | Key Events | Detects | Collection Method |54|-------------|-----------|---------|-------------------|55| **Zeek** | conn.log, dns.log, http.log, ssl.log, files.log | C2, exfil, lateral movement | Network tap / span port |56| **Suricata** | alert, flow, dns, http, tls | Known signatures + protocol anomalies | Inline or passive |57| **DNS Logs** | Query/response | C2 over DNS, DGA | DNS server logs, passive DNS |58| **Firewall Logs** | Allow/deny, NAT | Lateral movement, exfil | Syslog from firewall |59| **Proxy / WAF Logs** | HTTP requests, URL categories | Web-based C2, initial access | Proxy log export |60| **NetFlow / IPFIX** | Flow records | Volume anomalies, beaconing | Router/switch export |6162### EDR / XDR6364| Data Source | Key Events | Detects | Collection Method |65|-------------|-----------|---------|-------------------|66| **CrowdStrike Falcon** | ProcessRollup2, NetworkConnect, DnsRequest | Broad endpoint coverage | Falcon Data Replicator (FDR) |67| **Microsoft Defender for Endpoint** | DeviceProcessEvents, DeviceNetworkEvents | Broad endpoint coverage | Streaming API or Sentinel |68| **SentinelOne** | Process, File, Network telemetry | Broad endpoint coverage | API export |69| **Carbon Black** | Process, Netconn, Filemod | Broad endpoint coverage | Event Forwarder |7071## Field Mapping Comparison: CIM vs ECS vs Sigma vs Sentinel7273The same telemetry is named differently across schemas. This table maps common fields across all four platforms.7475### Process Creation Fields7677| Concept | Splunk CIM | Elastic ECS | Sigma (Generic) | Sentinel / MDE (KQL) |78|---------|-----------|-------------|-----------------|---------------------|79| Process name | `process_name` | `process.name` | `Image` | `FileName` |80| Command line | `process` | `process.command_line` | `CommandLine` | `ProcessCommandLine` |81| Process ID | `process_id` | `process.pid` | `ProcessId` | `ProcessId` |82| Parent process name | `parent_process_name` | `process.parent.name` | `ParentImage` | `InitiatingProcessFileName` |83| Parent command line | `parent_process` | `process.parent.command_line` | `ParentCommandLine` | `InitiatingProcessCommandLine` |84| User | `user` | `user.name` | `User` | `AccountName` |85| Hostname | `dest` | `host.name` | `Computer` | `DeviceName` |86| File hash (SHA256) | `process_hash` | `process.hash.sha256` | `Hashes` | `SHA256` |87| Timestamp | `_time` | `@timestamp` | N/A | `Timestamp` |8889### Network Connection Fields9091| Concept | Splunk CIM | Elastic ECS | Sigma | Sentinel / MDE (KQL) |92|---------|-----------|-------------|-------|---------------------|93| Source IP | `src` | `source.ip` | `SourceIp` | `LocalIP` |94| Destination IP | `dest` | `destination.ip` | `DestinationIp` | `RemoteIP` |95| Destination port | `dest_port` | `destination.port` | `DestinationPort` | `RemotePort` |96| Protocol | `transport` | `network.transport` | `Protocol` | `Protocol` |97| Bytes out | `bytes_out` | `source.bytes` | N/A | `SentBytes` |98| Application | `app` | `network.application` | N/A | N/A |99100### File Activity Fields101102| Concept | Splunk CIM | Elastic ECS | Sigma | Sentinel / MDE (KQL) |103|---------|-----------|-------------|-------|---------------------|104| File path | `file_path` | `file.path` | `TargetFilename` | `FolderPath` |105| File name | `file_name` | `file.name` | `TargetFilename` | `FileName` |106| File hash | `file_hash` | `file.hash.sha256` | `Hashes` | `SHA256` |107| Action | `action` | `event.action` | N/A | `ActionType` |108109### Key Sentinel / MDE Tables110111| Table | Data Source | Use For |112|-------|-----------|---------|113| `DeviceProcessEvents` | MDE agent | Process creation and execution |114| `DeviceNetworkEvents` | MDE agent | Network connections |115| `DeviceFileEvents` | MDE agent | File creation, modification, deletion |116| `DeviceRegistryEvents` | MDE agent | Registry modifications |117| `DeviceLogonEvents` | MDE agent | Authentication events |118| `SecurityEvent` | Azure Monitor Agent (legacy) | Windows Security Event Log |119| `Syslog` | Azure Monitor Agent | Linux syslog |120| `SigninLogs` | Azure AD connector | Azure AD authentication |121| `AuditLogs` | Azure AD connector | Azure AD administrative changes |122123## Technique to Data Source Mapping124125### High-Priority Techniques126127| Technique | Required Data Source(s) | Minimum Viable |128|-----------|------------------------|----------------|129| T1059.001 (PowerShell) | PowerShell 4104 + Sysmon 1 | PowerShell 4104 alone |130| T1059.003 (cmd.exe) | Sysmon 1 / Security 4688 | Security 4688 with cmd logging |131| T1003.001 (LSASS dump) | Sysmon 10 (ProcessAccess) | Sysmon 10 |132| T1053.005 (Sched. Task) | Security 4698/4702 + Sysmon 1 | Security 4698 |133| T1547.001 (Registry Run) | Sysmon 13 (Registry) | Sysmon 13 |134| T1021.001 (RDP) | Security 4624 Type 10 + Network | Security 4624 |135| T1071.001 (HTTP C2) | Zeek http.log / Proxy logs | Proxy logs |136| T1078.004 (Cloud Accounts) | Azure AD / CloudTrail | Cloud auth logs |137138## Using Data Source Mappings139140### For Detection Writing1411421. Identify the technique your detection covers1432. Look up required data sources in the table above1443. Check which schema your SIEM uses (CIM, ECS, or native)1454. Map field names accordingly1465. Verify the data source is actually being collected in your environment147148### For Gap Analysis149150If you lack a data source, you lack detection capability for techniques that depend on it. Use this mapping to:1511521. List all techniques you want to detect1532. Map each to required data sources1543. Compare against what you actually collect1554. Prioritize data source onboarding by technique coverage impact156157### For Test Environment Planning158159Use the data source mapping to determine what infrastructure your test lab needs. See the **Test Environment Builder** skill for building labs that produce specific data sources.
MHaggis