Cyber Security: Sources and Rules
The module's correlation rules are divided among six sources. Each source page describes its purpose, collection requirements, MITRE ATT&CK tactic coverage, and the role of lookups.
| Source | Data Analyzed |
|---|---|
| Windows | Windows workstation and server logs (Security, Sysmon, PowerShell, system logs, Windows Defender, and Windows DNS servers) |
| Active Directory | domain controller logs (Kerberos and NTLM authentication, directory changes, and certificate services) |
| Linux | Linux kernel audit subsystem (auditd) |
| Microsoft IIS | Microsoft IIS web server logs |
| nginx | nginx web server access logs |
| Kubernetes | kube-apiserver audit logs |
Documents Included with the Module
The "Cyber Security Expertise Description" document included with the module lists rules for each source and their MITRE ATT&CK tactics and techniques.