What Comes After Detection Rules? Smarter Detection Strategies in ATT&CK
Brief
By Lex Crumpton
Updated: October 22, 2025
Key updates:
- Website example images added
- No more Log Source SDO → log sources now live as a x_mitre_log_sources field on the Data Components SDO.
- No more SRO between Data Components and Techniques → Techniques now map to Detection Strategy SDOs.
Defenders have often used the information in ATT&CK Detections to help build useful analytics. But as detection engineering has matured, the current format hasn’t always scaled well. The text in ATT&CK’s Detections often packed too many behaviors into a single block of text, making them hard to interpret or apply.
Important platform differences were sometimes lost, and mapping from an adversary behavior to log telemetry, especially in complex environments, was more art than science.
Prepare to scale your mappings.