skills.rest
MHaggis
MHaggisCOMMUNITY
Explore all skills by this author →
Website𝕏@M_haggisGitHub

Data Source Mapper

Map MITRE ATT&CK techniques to data sources across SIEM schemas.

471|74|Updated Jan 13, 2026
Search Tags:#telemetry#threat intelligence#data sources#mitre att&ck#detection engineering#siem mapping
One-click install
npx skills add https://github.com/MHaggis/Security-Detections-MCP --skill data-source-mapper
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Data Source Mapper
Source: https://github.com/MHaggis/Security-Detections-MCP/tree/main/.claude/skills/data-source-mapper
Command: npx skills add https://github.com/MHaggis/Security-Detections-MCP --skill data-source-mapper

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses the challenge of understanding which specific data sources are required to detect various MITRE ATT&CK techniques, and how to map fields across different SIEM platforms.

Core Features & Use Cases

  • Technique-to-Data Source Mapping: Provides a clear mapping of ATT&CK techniques to essential data sources across endpoint, cloud, and network telemetry.
  • Cross-Schema Field Comparison: Compares and maps common field names across Splunk CIM, Elastic ECS, Sigma, and Sentinel/MDE (KQL).
  • Use Case: A security analyst needs to determine if their current logging covers the "LSASS dump" technique (T1003.001). They consult this skill to find that Sysmon Event ID 10 (ProcessAccess) is required and can then verify if this event is being collected and how its fields map to their SIEM.

Quick Start

Use the Data Source Mapper skill to find the required data sources for the T1059.001 technique.

Frequently Asked Questions about Data Source Mapper

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I map MITRE ATT&CK techniques to required data sources?▼

To map MITRE ATT&CK techniques to data sources, you match specific telemetry types like Windows, Linux, cloud, network, and EDR logs to the necessary event IDs and fields required for detecting each technique.

What data sources are needed to detect the LSASS dump technique?▼

Detecting the LSASS dump technique requires Sysmon Event ID 10 (ProcessAccess) from endpoint telemetry, which you can then verify is being collected and mapped correctly within your SIEM.

Can I map fields between Splunk CIM, Elastic ECS, Sigma, and KQL?▼

You can map fields between Splunk CIM, Elastic ECS, Sigma, and KQL by comparing common field names across these SIEM schemas to ensure consistent cross-platform detection engineering.

How do I perform a data source gap analysis for detection engineering?▼

Performing data source gap analysis involves mapping MITRE ATT&CK techniques to required telemetry types and verifying if your current logging infrastructure captures the necessary events across endpoint, cloud, and network platforms.

Does this mapping approach work across both endpoint and cloud telemetry?▼

This mapping approach works across endpoint and cloud telemetry by mapping MITRE ATT&CK techniques to necessary data sources across diverse telemetry types including Windows, Linux, cloud, network, and EDR.

What SIEM schema knowledge is required for cross-platform field mapping?▼

Cross-platform field mapping requires an understanding of SIEM schemas and threat intelligence frameworks to accurately compare and translate fields across Splunk CIM, Elastic ECS, Sigma, and Sentinel.

Related Skills

Explore More Software Engineering Skills→
jassicsjassics
6

attack-lookup

Map observed behaviors to MITRE ATT&CK technique IDs and references.

Community
Intermediate
woohyun212woohyun212
21

siem-rule

Convert threat objectives into Sigma rules and cross-platform SIEM detection queries.

Community
Advanced
4lerman4lerman

threat-detection

Score hunting hypotheses against MITRE ATT&CK techniques and IOC data.

Community
Advanced
augustoheissaugustoheiss

agency-threat-detection-engineer

Detect attacker behaviors in telemetry and generate tested Sigma-based SIEM rules.

Community
Advanced