elastic / elastic/detection-rules
[FR] Align "Data Source" tags with MITRE
- Langage dominant
- Python
- Étoiles
- 2.7k
- Forks
- 696
- Merge moyen
- 5 j 1 h
- PR mergées (30 j)
- 72
Description
**Is your feature request related to a problem? Please describe.**
I feel like aligning the `Data Source` tags with the [MITRE Data Sources](https://attack.mitre.org/datasources/) suppliments
the existing MITRE ATT&CK mappings. Further building on an existing framework.
**Describe the solution you'd like**
Allow the `Data Source` tags to have the name of the sources mentioned in [MITRE](https://attack.mitre.org/datasources/).
E.g:
```
tags = ["Data Source: Container"]
```
**Describe alternatives you've considered**
Manually updating the definition file in our repository.
**Additional context**
I don't believe it should be 100% mapped. As in only those values should be allowed. But I do think the rules where possible
should have them tagged and custom rules should have the option.
Guide de contribution
Ouvrir le guide de contribution
Évaluation
Cette issue n'a pas encore été évaluée.