>> Welcome to Module 1,
Lesson 6 data sources and detections.
In this lesson, we will define and
explore what are attack data sources and
detections and appreciation for
the relationship between
these data sources and detections.
Finally, identify how data sources
and detections are applied to and can
be used by defenders relative to
specific techniques and subject needs.
As you recall from Lesson 4,
attack techniques and sub-techniques
have a wealth of many data.
In this lesson, we will explore
data sources and detections
and how defenders can use these values to
begin to detect adversary behaviors.
We will also explore updates and refinements to
the data sources methodology and
model as of attack Version 9.
Attack defines data sources as
the sources of information collected by sensing
or logging systems that we defenders can use to
identify adversary actions and techniques.
In short, you can think of this as where to collect data.
Historically, attack use data source
values such as process monitoring,
PowerShell logs, or packet capture to
point defenders to where
they need to collect information.
But as of attack Version 9,
we've updated this data source model to more
specifically and consistently capture
the exact data records of defenders.
For example, where we would have
previously used process monitoring we would now
list the data source as process to define
the need for information about
processes and our environment.
Building on that data source process,
we would add a data component to
specify what exact value or information
about a process we need to identify
the specific technique or sub-technique.
As you can see from the example on the right,
we would need process access other processes,
execution of API functions from a process,
as well as potentially creation of processes to
identify the credential
dumping LSASS memory sub-technique.
We hope that this model enables
us to more efficiently map from
the information captured within attack to
specific events and logs in their environment.
In the future, these data sources will be
full objects within the attack model but for now
they're linked to our GitHub where you can
read more about each data source and data component,
including definitions and mappings to
which specific platforms they are applied.
Building on data sources,
attack also provide detections,
which are high level analytic processes
or detection strategies that
we can use to identify techniques.
In short, detections provide
how to interpret the collected data.
If you go to any type of technique or
sub-technique you'll see how these values are applied.
Specifically as I said before,
data sources tell us what information we
should collect and what particular values are needed,
as well as detections telling us what to do with
that data and how to actually
analyze it to make sense of it,
to identify the specific behavior.
You'll also noticed there's a very intentional parallel
between the inputs and how to actually process the data.
Strictly data source is telling us what information goes
in and detection is telling us what to do with that data.
With that, we've reached the end of
Lesson 6 and our knowledge check.
Attack data sources tell us,
please pause the video for a moment and take a
second to think of the correct answer before proceeding.
This case, the correct response
was C. Attack data sources
tell us what data we should collect via sensors or logs.
With that we've reached the end of
Lesson 6 and our summary.
In conclusion attack data sources
tell us what data to collect.
Detections tell us how to analyze,
process, and make sense of that collected data.
Finally, these data sources and detections are applied
specifically to each technique
and sub-technique within attack.