rabobank-cdc/DeTTECT

Data sources missing

irivera007 opened this issue · 4 comments

irivera007 commented

HI,

When running in docker or locally, Im unable to see more data sources for instance "AWS CloudTrail logs" from the drop menu:
image

any idea on what am I missing?

rubinatorz commented

hi @irivera007

"AWS CloudTrail logs" is a data source from the previous ATT&CK version (8.0 and before). MITRE restructured and renewed the data sources in version 9.0 and "AWS CloudTrail logs" in not in there.

beerMT commented

I found a similar Data Source missing issue when looking at:

  • Logon Session Termination
  • Scheduled Job Deletion

Other Logon Session data components and Scheduled Job data components were available in the Editor but not those two.

rubinatorz commented

hi @beerMT,

Those 2 data sources are indeed part of ATT&CK v9, but there are no (sub) techniques referencing to this data sources. That's why you don't see those data sources in the Editor. Those data sources would not reflect any visibility on (sub) techniques (yet).

  • 👍1
beerMT commented

Good catch, thanks for clarification.

  • 👍1