Data sources per platform

Content:

• Enterprise
• Mobile
• ICS

Enterprise

The below mapping from data sources/data components to platforms is created on the information provided by MITRE within the data source objects. Also, note that the below is only listing data components that are actually referenced by a technique. Therefore it does not include all data components as referenced in the STIX repository.

Data source	PRE	Windows	macOS	Linux	Office Suite	Identity Provider	SaaS	IaaS	Network Devices	Containers	ESXi
DHCP [DeTT&CT data source]		X	X	X
Email [DeTT&CT data source]		X	X	X	X		X
Internal DNS [DeTT&CT data source]		X	X	X				X	X	X
Web [DeTT&CT data source]		X	X	X	X		X	X	X	X

Mobile

The below mapping from data sources/data components to platforms is created on the information provided by MITRE within the data source objects. Also, note that the below is only listing data components that are actually referenced by a technique. Therefore it does not include all data components as referenced in the STIX repository.

DeTT&CT data sources

At this moment we do not have any DeTT&CT data sources for Mobile. If there is a need or if you do have a suggestion, we will look into this.

Data source	Android	iOS

ICS

Official platform mapping is missing

An official mapping for ICS sources/data components to platforms is currently missing. Since v14 release of ATT&CK platforms are not being used anymore for ICS. Therefor we cannot generate data source - platform mappings for ICS.

DeTT&CT data sources

As we do not consider ourselves experts in the field of ICS, we have not included the DeTT&CT data sources. Any help and thus contributions on that matter are very much appreciated. Possibly, with future developments of ATT&CK ICS, we could automate this part when Detection objects are introduced. However, it is not certain whether this will provide good results.