Skip to content

Slot: x_mitre_log_sources

Platform-specific log collection configurations for this data component. Each entry specifies a log source provider name and a channel/event type identifier that together pinpoint where to collect relevant telemetry. Each (name, channel) pair must be unique within the array. This property is optional in ATT&CK Specification 3.x but will become required in ATT&CK Specification 4.x.

URI: attack:x_mitre_log_sources Alias: x_mitre_log_sources

Applicable Classes

Name Description Modifies Slot
DataComponent Data Components represent specific types of observable events or artifacts wi... yes

Properties

Type and Range

Property Value
Range LogSource
Domain Of DataComponent

Cardinality and Requirements

Property Value
Multivalued Yes

In Subsets

Comments

  • jsonschema_minItems: "1" validator_hint: no-duplicate-name-channel-pairs

Identifier and Mapping Information

Schema Source

  • from schema: https://w3id.org/lmodel/attack

Mappings

Mapping Type Mapped Value
self attack:x_mitre_log_sources
native attack:x_mitre_log_sources

LinkML Source

name: x_mitre_log_sources
description: Platform-specific log collection configurations for this data component.
  Each entry specifies a log source provider name and a channel/event type identifier
  that together pinpoint where to collect relevant telemetry. Each (name, channel)
  pair must be unique within the array. This property is optional in ATT&CK Specification
  3.x but will become required in ATT&CK Specification 4.x.
comments:
- 'jsonschema_minItems: "1" validator_hint: no-duplicate-name-channel-pairs'
in_subset:
- attack_sdos
from_schema: https://w3id.org/lmodel/attack
rank: 1000
alias: x_mitre_log_sources
domain_of:
- DataComponent
range: LogSource
multivalued: true
inlined: true