Data sources missing about dettect

[rubinatorz]

hi @beerMT,

Those 2 data sources are indeed part of ATT&CK v9, but there are no (sub) techniques referencing to this data sources. That's why you don't see those data sources in the Editor. Those data sources would not reflect any visibility on (sub) techniques (yet).

[beerMT]

Good catch, thanks for clarification.

[rubinatorz]

hi @irivera007

"AWS CloudTrail logs" is a data source from the previous ATT&CK version (8.0 and before). MITRE restructured and renewed the data sources in version 9.0 and "AWS CloudTrail logs" in not in there.

[beerMT]

I found a similar Data Source missing issue when looking at:

• Logon Session Termination
• Scheduled Job Deletion

Other Logon Session data components and Scheduled Job data components were available in the Editor but not those two.