An ATT&CK data source describes a category of information that can support detection, such as process, file, network, cloud, or identity telemetry. Data sources help teams identify what evidence is needed to observe a behavior.
How this term helps security teams
Glexia maps data sources to logging gaps, SIEM coverage, and detection engineering priorities.
Where practitioners use this concept
- SOC telemetry assessment
- SIEM onboarding
- Detection coverage mapping
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.