What is data component in MITRE ATT&CK®?

A data component is a more specific type of observable event or property within an ATT&CK data source. For example, process creation is a component of process telemetry.

40-second answer

A data component is a more specific type of observable event or property within an ATT&CK data source. For example, process creation is a component of process telemetry.

Glexia analyst context

How this term helps security teams

Glexia uses data components to turn broad logging goals into concrete collection and parser requirements.

Common use cases

Where practitioners use this concept

Log source validation
Parser development
Detection requirements

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use