This part of the OSSEM project focuses on the documentation of ATT&CK data sources suggested or associated with techniques defined in the https://attack.mitre.org/wiki/Technique_Matrix. In addition, here is where ATT&CK data sources will be mapped with specific sub data sources defined in the /detection_data_model with the main goal of creating a link between ATT&CK data sources and event logs.

Data source (Process Monitoring) mapped to specific event logs example

Sub Data Sets

tables	Description	Tags
Data Sources	None

References

Enterprise Matrix
Jupyter notebook to explore ATT&CK data sources
ATT&CKcon 2018 - Slides and demos documents
ATT&CK Data Sources mapped to Event Logs