MITRE ATT&CK

MITRE ATT&CK is a community-driven knowledge base mapping adversary tactics, techniques and procedures for threat modelling.

Global Fields (4)

FieldType
ngs.id
Unique identifier for the log entry.
string
ngs.createdAt
Timestamp when the event was created locally.
pdate
ngs.indexedAt
Timestamp when the log was indexed into the SIEM.
pdate
ngs.source
Origin or source system of the log.
string

Reference-Specific Fields (5)

FieldType
mitre.id
MITRE ATT&CK identifier of the technique or sub-technique (e.g., "T1059").
string
mitre.sub
Sub-technique identifier, if applicable (e.g., "T1059.001").
string
mitre.type
Record type categorising the ATT&CK object (e.g., tactic, technique, sub-technique).
text_general
mitre.name
Human-readable name of the technique or tactic.
text_general
mitre.tactics
Array of ATT&CK tactic identifiers associated with the object.
text_general []

Sample Log Event

Below is a representative JSON log entry showing key fields as they're emitted by the system. Depending on the context of the event, some fields may be omitted if they're not applicable.