Log sources

The 261 log sources ATT&CK v19.2 analytics name, inverted: pick the log you have and see which techniques — and which actively exploited CVEs — it can reach.

Derived from x_mitre_log_source_references on 1758 analytics (4182 references). Names are MITRE's verbatim; a source appearing twice under slightly different spellings is a source problem and is left visible.

Log source	Platforms	Channels	Analytics	Techniques	KEV CVEs reachable
WinEventLog:Sysmon	IaaS, Linux, Office Suite, Windows, macOS	24	435	423	418
macos:unifiedlog	macOS	499	350	348	419
auditd:SYSCALL	Containers, Linux, macOS	276	344	331	418
WinEventLog:Security	Identity Provider, Office Suite, Windows	54	284	280	270
NSM:Flow	Containers, ESXi, Linux, Network Devices, Windows, macOS	229	235	131	274
macos:osquery	macOS	59	94	94	140
AWS:CloudTrail	Containers, IaaS, Identity Provider, SaaS, Windows	106	92	89	119
linux:syslog	Linux, Network Devices	77	81	80	138
m365:unified	Identity Provider, Office Suite, SaaS, Windows	86	82	70	83
WinEventLog:PowerShell	Office Suite, Windows	13	65	64	26
esxi:hostd	ESXi, IaaS	51	54	53	221
linux:osquery	Linux	38	48	47	42
esxi:vmkernel	ESXi	43	47	46	104
networkdevice:syslog	Linux, Network Devices	53	47	46	200
auditd:EXECVE	Linux	35	45	44	21
WinEventLog:System	Windows	20	39	38	28
esxi:shell	ESXi	32	37	36	47
macos:endpointsecurity	macOS	23	35	35	152
azure:signinlogs	Identity Provider, Office Suite, SaaS, Windows	34	35	33	56
fs:fsusage	macOS	30	31	31	74
Internet Scan	PRE	1	27	27	14
NSM:Connections	Identity Provider, Linux, Network Devices, Windows, macOS	24	25	23	141
WinEventLog:Application	Office Suite, Windows	20	22	22	98
networkdevice:cli	Network Devices	20	21	21	211
AWS:VPCFlowLogs	IaaS	16	16	16	177
auditd:PATH	Linux	14	16	16	12
saas:okta	Identity Provider, SaaS	17	16	16	55
Network Traffic	PRE, Windows	1	15	15	2
networkdevice:config	Network Devices	14	14	14	6
etw:Microsoft-Windows-Kernel-Process	Windows	12	12	12	43
auditd:FILE	Linux	11	11	11	3
linux:Sysmon	Linux	5	11	11	32
m365:exchange	Office Suite, Windows	12	12	11	6
NSM:Firewall	ESXi, Network Devices, Windows, macOS	12	12	10	6
azure:audit	Identity Provider, Office Suite	11	10	10	12
kubernetes:audit	Containers, Linux	11	11	10	72
AWS:CloudWatch	IaaS	9	9	9	30
azure:activity	IaaS, Identity Provider, Windows	9	9	9	1
esxi:syslog	ESXi	9	9	9	12
esxi:vpxd	ESXi	9	9	9	11
kubernetes:apiserver	Containers	10	9	9	4
docker:daemon	Containers	8	8	8	6
docker:events	Containers	9	8	8	171
ebpf:syscalls	Containers, IaaS, Linux	9	8	8	17
gcp:audit	IaaS, Office Suite, SaaS	11	11	8	8
m365:signinlogs	Office Suite, SaaS	7	9	8	2
Malware Repository	PRE	1	7	7	3
WinEventLog:Microsoft-Windows-CodeIntegrity/Operational	Windows	7	7	7	3
fs:fileevents	Linux, macOS	6	7	7	4
fs:fsevents	macOS	7	7	7	54
Application Log	PRE	1	6	6	1
Application:Mail	Linux	6	6	6	18
WinEventLog:WMI	Windows	2	6	6	2
auditd:CONFIG_CHANGE	Linux	6	6	6	2
esxi:auth	ESXi	6	6	6	15
saas:googleworkspace	SaaS	7	6	6	6
saas:slack	SaaS	6	6	6	3
Domain Name	PRE	1	5	5	0
containerd:Events	Containers, Linux	5	5	5	24
containerd:runtime	Containers	5	5	5	79
linux:cli	Linux	5	5	5	9
m365:messagetrace	Office Suite, Windows	5	5	5	0
macos:syslog	macOS	4	5	5	46
saas:auth	Identity Provider, SaaS	5	5	5	21
saas:salesforce	SaaS	5	5	5	1
saas:zoom	SaaS	5	5	5	4
Persona	PRE	1	4	4	0
Windows:perfmon	Windows	4	4	4	21
auditd:PROCTITLE	Linux	4	4	4	1
esxcli:network	ESXi	4	4	4	4
linux:cron	Linux	2	4	4	0
m365:defender	Identity Provider, Office Suite, Windows	4	4	4	14
m365:sharepoint	Office Suite, Windows	4	4	4	2
EDR:file	Windows	3	3	3	0
PF:Logs	macOS	3	3	3	25
WinEventLog:Microsoft-Windows-Windows Firewall With Advanced Security/Firewall	Windows	2	3	3	0
WinEventLog:TaskScheduler	Windows	2	3	3	3
auditd:USER_LOGIN	Linux	2	3	3	3
esxi:cron	ESXi	3	3	3	2
esxi:vobd	ESXi	3	3	3	170
esxi:vpxa	ESXi	3	3	3	15
gcp:workspaceaudit	Identity Provider, SaaS	3	3	3	0
iptables:LOG	Linux	2	3	3	35
journald:package	Linux	3	3	3	3
kubernetes:events	Containers, Linux	3	3	3	7
m365:office	Office Suite	4	3	3	0
saas:audit	SaaS	3	3	3	0
saas:box	SaaS	3	3	3	3
Certificate	PRE	1	2	2	1
EDR:AMSI	Windows	2	2	2	0
EDR:detection	Linux, Windows	2	2	2	0
EDR:hunting	Windows	2	2	2	0
ETW:Token	Windows	2	2	2	1
Firewall Audit Logs	Network Devices	2	2	2	1
NSM:Content	ESXi, Windows, macOS	3	3	2	0
Okta:SystemLog	IaaS, Identity Provider	2	2	2	0
OpenBSM:AuditTrail	macOS	2	2	2	0
WinEventLog:Microsoft-Office-Alerts	Windows	2	2	2	0
WinEventLog:Microsoft-Windows-Windows Defender/Operational	Windows	2	2	2	6
WinEventLog:Windows Defender	Windows	2	2	2	0
auditd:MMAP	Linux	2	2	2	0
azure:policy	Identity Provider	3	3	2	2
dns:query	Windows	2	2	2	0
esxi:esxupdate	ESXi	2	2	2	0
etw:Microsoft-Windows-Win32k	Windows	2	2	2	0
etw:Microsoft-Windows-WinINet	Windows	2	2	2	0
journald:systemd	Linux	2	2	2	7
linux:auth	Linux	2	2	2	1
linux:procfs	Linux	2	2	2	38
macos:keychain	macOS	2	2	2	18
networkconfig	Linux, Network Devices	2	2	2	2
networkdevice:firmware	Network Devices	2	2	2	2
networkdevice:runtime	Network Devices	2	2	2	0
saas:access	SaaS	2	2	2	0
saas:application	SaaS	2	2	2	19
saas:confluence	SaaS	3	2	2	2
saas:github	SaaS	6	2	2	0
saas:googledrive	SaaS	2	2	2	0
vpxd.log	ESXi	2	2	2	1
ALB:HTTPLogs	IaaS	1	1	1	157
AWS:CloudMetrics	IaaS	1	1	1	0
Apple TCC Logs	macOS	1	1	1	0
ApplicationLog:API	Containers	1	1	1	25
ApplicationLog:CallRecords	Windows	1	1	1	0
ApplicationLog:EntraIDPortal	Identity Provider	1	1	1	0
ApplicationLog:IIS	Windows	1	1	1	157
ApplicationLog:Ingress	Containers	1	1	1	157
ApplicationLog:Intune/MDM Logs	Windows	1	1	1	0
ApplicationLog:MailServer	Linux	1	1	1	0
ApplicationLog:WebServer	Linux	1	1	1	157
ApplicationLogs:SQL	Linux	1	1	1	0
Autoruns:RegistryScan	Windows	1	1	1	0
CloudTrail:GetCallerIdentity	IaaS	1	1	1	0
CloudTrail:GetObject	IaaS	1	1	1	3
CloudTrail:PutObject	IaaS	1	1	1	0
CloudTrail:Signin	IaaS	1	1	1	0
EDR:Telemetry	Windows	1	1	1	0
EDR:cli	Windows	1	1	1	0
EDR:memory	Windows	1	1	1	0
EDR:scriptblock	Windows	1	1	1	6
ESXiLogs:authlog	ESXi	1	1	1	0
ESXiLogs:messages	ESXi	1	1	1	0
ETW	Windows	1	1	1	0
ETW:ProcThread	Windows	1	1	1	0
GCPAuditLogs:login.googleapis.com	SaaS	1	1	1	0
Google Admin Audit	SaaS	1	1	1	0
IDS:TLSInspection	Network Devices	1	1	1	0
M365Defender:DeviceNetworkEvents	Windows	1	1	1	0
Microsoft Entra ID Audit Logs	Identity Provider	1	1	1	0
Microsoft Graph API Logs	Office Suite	1	1	1	0
NSX:FlowLogs	ESXi	1	1	1	0
NetFlow:Flow	Linux	1	1	1	43
Netfilter/iptables	Linux	1	1	1	0
VPCFlowLogs:All	IaaS	1	1	1	7
WIDS:AssociationLogs	Network Devices	1	1	1	0
WLANLogs:Association	Network Devices	1	1	1	0
WinEventLog:ADFS	Windows	1	1	1	0
WinEventLog:AppLocker	Windows	1	1	1	0
WinEventLog:CodeIntegrity	Windows	1	1	1	0
WinEventLog:Kerberos	Windows	1	1	1	0
WinEventLog:Microsoft-IIS-Configuration	Windows	1	1	1	0
WinEventLog:Microsoft-Office/OutlookAddinMonitor	Office Suite	1	1	1	0
WinEventLog:Microsoft-Windows-Backup	Windows	1	1	1	2
WinEventLog:Microsoft-Windows-COM/Operational	Windows	1	1	1	0
WinEventLog:Microsoft-Windows-Kernel-Boot	Windows	1	1	1	2
WinEventLog:Microsoft-Windows-SMBClient/Security	Windows	1	1	1	0
WinEventLog:Microsoft-Windows-Security-Mitigations/KernelMode	Windows	1	1	1	0
WinEventLog:Microsoft-Windows-Shell-Core	Windows	1	1	1	1
WinEventLog:Microsoft-Windows-TCPIP	Windows	1	1	1	0
WinEventLog:Microsoft-Windows-VSS	Windows	1	1	1	3
WinEventLog:Microsoft-Windows-WLAN-AutoConfig	Windows	1	1	1	0
WinEventLog:Microsoft-Windows-Windows Camera Frame Server/Operational	Windows	1	1	1	0
WinEventLog:WinRM	Windows	1	1	1	0
WinEventLog:iis	Windows	1	1	1	0
Windows Firewall Log	Windows	1	1	1	1
apache:access_log	Linux	1	1	1	0
auditd:AUTH	Linux	1	1	1	0
auditd:DAEMON	Linux	1	1	1	0
auditd:FS	Linux	1	1	1	0
auditd:file-events	Linux	1	1	1	0
auditd:memprotect	Linux	1	1	1	0
azure:ad	Office Suite	1	1	1	3
azure:vmguest	IaaS	1	1	1	0
azure:vpcflow	IaaS	1	1	1	0
cni:netflow	Containers	1	1	1	3
container:cni	Containers	1	1	1	19
container:proxy	Containers	1	1	1	0
containers:osquery	Containers	1	1	1	0
desktop:file_manager	Linux	1	1	1	0
docker:api	Containers	1	1	1	0
docker:registry	Containers	1	1	1	0
docker:runtime	Containers	2	2	1	0
docker:stats	Containers	1	1	1	0
ebpf:tracepoints	Linux	1	1	1	0
esxi:vob	ESXi	1	1	1	0
esxis:vmkernel	ESXi	1	1	1	46
etw:Microsoft-Antimalware-Scan-Interface	Windows	1	1	1	0
etw:Microsoft-Windows-Directory-Services-SAM	Windows	1	1	1	0
etw:Microsoft-Windows-DotNETRuntime	Windows	1	1	1	0
etw:Microsoft-Windows-Kernel-Base	Windows	1	1	1	0
etw:Microsoft-Windows-Kernel-File	Windows	1	1	1	0
etw:Microsoft-Windows-Kernel-Storage	Windows	1	1	1	0
etw:Microsoft-Windows-NDIS-PacketCapture	Windows	1	1	1	0
etw:Microsoft-Windows-RPC	Windows	1	1	1	0
etw:Microsoft-Windows-Security-Auditing	Windows	1	1	1	0
firmware:integrity	Windows	1	1	1	0
firmware:runtime	Network Devices	1	1	1	0
fs:filesystem	macOS	1	1	1	0
fs:launchdaemons	macOS	2	1	1	0
fs:plist	macOS	1	1	1	0
fs:plist_monitoring	macOS	1	1	1	0
fs:quarantine	macOS	1	1	1	0
fwupd:logs	Linux	1	1	1	0
gatekeeper/quarantine database	macOS	1	1	1	0
gcp:config	IaaS	1	1	1	0
gcp:iam	Identity Provider	1	1	1	0
gcp:vpcflow	IaaS	1	1	1	2
journald:Application	Linux	1	1	1	2
kubernetes:orchestrator	Containers	1	1	1	0
linus:syslog	Linux	1	1	1	0
linux:fim	ESXi	1	1	1	0
linux:shell	Linux	1	1	1	0
linuxsyslog	Linux	1	1	1	5
m365:audit	Identity Provider	1	1	1	0
m365:dirsync	Windows	1	1	1	0
m365:mailboxaudit	Office Suite	1	1	1	0
m365:oauth	Office Suite	1	1	1	0
m365:purview	Office Suite, Windows	2	2	1	1
m365:teams	Office Suite	1	1	1	0
macos:MDM	macOS	1	1	1	0
macos:auth	macOS	1	1	1	1
macos:cron	macOS	1	1	1	0
macos:fsevents	macOS	1	1	1	0
macos:jamf	macOS	1	1	1	0
macos:launchd	macOS	1	1	1	0
network:auth	Network Devices	1	1	1	0
networkdevice:Firewall	Network Devices	3	1	1	0
networkdevice:Flow	Network Devices	1	1	1	0
networkdevice:IDS	Network Devices	1	1	1	5
networkdevice:audit	Network Devices	1	1	1	0
networkdevice:controlplane	Network Devices	1	1	1	157
prometheus:metrics	Containers	1	1	1	19
saas-app:auth	SaaS	1	1	1	0
saas:PRMetadata	SaaS	1	1	1	0
saas:RepoEvents	SaaS	1	1	1	0
saas:Snowflake	SaaS	1	1	1	0
saas:adminapi	SaaS	1	1	1	0
saas:api	SaaS	1	1	1	0
saas:appsscript	SaaS	1	1	1	0
saas:collaboration	SaaS	1	1	1	6
saas:email	Office Suite	1	1	1	0
saas:finance	SaaS	1	1	1	0
saas:integration	SaaS	1	1	1	0
sar:network	Linux	1	1	1	0
snmp:access	Network Devices	1	1	1	0
snmp:status	Network Devices	1	1	1	0
snmp:syslog	Network Devices	1	1	1	35
snmp:trap	Network Devices	1	1	1	1
systemd:unit	Containers	1	1	1	0
windows:osquery	Windows	1	1	1	0
wineventlog:dhcp	Windows	1	1	1	0