MITRE ATT&CK Windows Enrichment

Docs > Observability Pipelines > Packs > MITRE ATT&CK Windows Enrichment

Overview

The MITRE ATT&CK Windows Enrichment pack

This pack tags Windows event logs with MITRE ATT&CK tactics and techniques.

What this pack does:

Tags events with MITRE techniques
Maps logons, account changes, and execution events
Flags events as security-relevant