threat.yml

---
- name: threat
  title: Threat
  group: 2
  short: Fields to classify events and alerts according to a threat taxonomy.
  description: >
   Fields to classify events and alerts according to a threat taxonomy such as the MITRE ATT&CK® framework.

   These fields are for users to classify alerts from all of their sources (e.g. IDS, NGFW, etc.) within a
   common taxonomy. The threat.tactic.* are meant to capture the high level category of the threat
   (e.g. "impact"). The threat.technique.* fields are meant to capture which kind of approach is used by
   this detected threat, to accomplish the goal (e.g. "endpoint denial of service").

  type: group
  fields:

    - name: framework
      level: extended
      type: keyword
      short: Threat classification framework.
      description: >
        Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat.
        Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.

      example: MITRE ATT&CK

    - name: tactic.id
      level: extended
      type: keyword
      short: Threat tactic id.
      description: >
          The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example.
          (ex. https://attack.mitre.org/tactics/TA0002/ )

      example: TA0002
      normalize:
        - array

    - name: tactic.name
      level: extended
      type: keyword
      short: Threat tactic.
      description: >
          Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example.
          (ex. https://attack.mitre.org/tactics/TA0002/)

      example: Execution
      normalize:
        - array


    - name: tactic.reference
      level: extended
      type: keyword
      short: Threat tactic URL reference.
      description: >
          The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example.
          (ex. https://attack.mitre.org/tactics/TA0002/ )

      example: https://attack.mitre.org/tactics/TA0002/
      normalize:
        - array


    - name: technique.id
      level: extended
      type: keyword
      short: Threat technique id.
      description: >
          The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example.
          (ex. https://attack.mitre.org/techniques/T1059/)

      example: T1059
      normalize:
        - array

    - name: technique.name
      level: extended
      type: keyword
      multi_fields:
      - type: text
        name: text
      short: Threat technique name.
      description: >
          The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example.
          (ex. https://attack.mitre.org/techniques/T1059/)

      example: Command and Scripting Interpreter
      normalize:
        - array

    - name: technique.reference
      level: extended
      type: keyword
      short: Threat technique URL reference.
      description: >
          The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example.
          (ex. https://attack.mitre.org/techniques/T1059/)

      example: https://attack.mitre.org/techniques/T1059/
      normalize:
        - array

    - name: technique.subtechnique.id
      level: extended
      type: keyword
      short: Threat subtechnique id.
      description: >
          The full id of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example.
          (ex. https://attack.mitre.org/techniques/T1059/001/)

      example: T1059.001
      normalize:
        - array

    - name: technique.subtechnique.name
      level: extended
      type: keyword
      multi_fields:
      - type: text
        name: text
      short: Threat subtechnique name.
      description: >
          The name of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example.
          (ex. https://attack.mitre.org/techniques/T1059/001/)

      example: PowerShell
      normalize:
        - array

    - name: technique.subtechnique.reference
      level: extended
      type: keyword
      short: Threat subtechnique URL reference.
      description: >
          The reference url of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example.
          (ex. https://attack.mitre.org/techniques/T1059/001/)

      example: https://attack.mitre.org/techniques/T1059/001/
      normalize:
        - array