elastic / elastic/detection-rules

[FR] Align "Data Source" tags with MITRE

Open
#3,290 2 comments 0 reactions 0 assignees View on GitHub
backlog community enhancement
Dominant language
Python
Stars
2.7k
Forks
696
Avg merge
4d 17h
Merged PRs (30d)
87

Description

**Is your feature request related to a problem? Please describe.**
I feel like aligning the `Data Source` tags with the [MITRE Data Sources](https://attack.mitre.org/datasources/) suppliments
the existing MITRE ATT&CK mappings. Further building on an existing framework.

**Describe the solution you'd like**
Allow the `Data Source` tags to have the name of the sources mentioned in [MITRE](https://attack.mitre.org/datasources/).
E.g:
```
tags = ["Data Source: Container"]
```

**Describe alternatives you've considered**
Manually updating the definition file in our repository.

**Additional context**
I don't believe it should be 100% mapped. As in only those values should be allowed. But I do think the rules where possible
should have them tagged and custom rules should have the option.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.