elastic / elastic/detection-rules

[FR] Align "Data Source" tags with MITRE

Ouverte
#3,290 2 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
backlog community enhancement
Langage dominant
Python
Étoiles
2.7k
Forks
696
Merge moyen
5 j 1 h
PR mergées (30 j)
72

Description

**Is your feature request related to a problem? Please describe.**
I feel like aligning the `Data Source` tags with the [MITRE Data Sources](https://attack.mitre.org/datasources/) suppliments
the existing MITRE ATT&CK mappings. Further building on an existing framework.

**Describe the solution you'd like**
Allow the `Data Source` tags to have the name of the sources mentioned in [MITRE](https://attack.mitre.org/datasources/).
E.g:
```
tags = ["Data Source: Container"]
```

**Describe alternatives you've considered**
Manually updating the definition file in our repository.

**Additional context**
I don't believe it should be 100% mapped. As in only those values should be allowed. But I do think the rules where possible
should have them tagged and custom rules should have the option.

Guide de contribution

Ouvrir le guide de contribution

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.