How do I map log sources to ATT&CK techniques in Intelligence View?

Select data sources in the header filter, use filtered-only or highlight mode on the matrix, then validate platform, log source, channel, and data component rows in the Detections tab per technique.

What log sources does ATT&CK v19.1 map most often?

Common mappings include WinEventLog:Sysmon and Windows Security on endpoints, auditd and journald on Linux, CloudTrail and Azure activity logs in cloud, plus network DNS and proxy logs for C2 and exfiltration techniques.

What if a technique has no telemetry rows?

ATT&CK v19.1 may document the behavior without mapped log sources yet. Treat it as a logging or detection gap and track it in your assessment rather than assuming coverage.

ATT&CK Intelligence View

ATT&CK Intelligence View — a community-focused MITRE ATT&CK matrix explorer with connected filters, detection strategies, D3FEND mappings, and technique intelligence. Compare with the official MITRE ATT&CK® Navigator in the guide.