Docs

Detection Categories

Suggest Edits

Detection categories are similar to flow tags. They are used to group or ‘categorize’ detection models, after which rules - based on categories - can be crafted.

System

The system categories are based off the MITRE ATT&CK® framework.

Short nameLong name
configurationNeto_configuration
iprepIP Reputation Based
p2pPeer To Peer
policyPolicy
rateRate Based
securitySecurity
t1001T1001 Data Obfuscation
t1007T1007 System Service Discovery
t1008T1008 Fallback Channels
t1011T1011 Exfiltration Over Other Network Medium
t1016T1016 System Network Configuration Discovery
t1018T1018 Remote System Discovery
t1020T1020 Automated Exfiltration
t1021T1021 Remote Services
t1033T1033 System Owner or User Discovery
t1040T1040 Network Sniffing
t1041T1041 Exfiltration Over C2 Channel
t1043T1043 Commonly Used Port
t1046T1046 Network Service Scanning
t1048T1048 Exfiltration Over Alternative Protocol
t1049T1049 System Network Connections Discovery
t1082T1082 System Information Discovery
t1083T1083 File and Directory Discovery
t1090T1090 Proxy
t1095T1095 Non-Application Layer Protocol
t1102T1102 Web Service
t1110T1110 Brute Force
t1119T1119 Automated Collection
t1124T1124 System Time Discovery
t1133T1133 External Remote Services
t1135T1135 Network Share Discovery
t1136T1136 Create Account
t1189T1189 Drive-by Compromise
t1204T1204 User Execution
t1205T1205 Traffic Signaling
t1207T1207 Rogue Domain Controller
t1219T1219 Remote Access Software
t1482T1482 Domain Trust Discovery
t1498T1498 Network Denial of Service
t1499T1499 Endpoint Denial of Service
t1518T1518 Software Discovery
t1526T1526 Cloud Service Discovery
t1534T1534 Internal Spearphishing
t1535T1535 Unused Unsupported Cloud Regions
t1537T1537 Transfer Data to Cloud Account
t1538T1538 Cloud Service Dashboard
t1557T1557 Adversary-in-the-Middle
t1562T1562 Impair Defenses
t1563T1563 Remote Service Session Hijacking
t1566T1566 Phishing
t1567T1567 Exfiltration Over Web Service
t1568T1568 Dynamic Resolution
t1571T1571 Non-Standard Port
t1572T1572 Protocol Tunneling
t1573T1573 Encrypted Channel
t1578T1578 Modify Cloud Compute Infrastructure
t1580T1580 Cloud Infrastructure Discovery
t1583T1583 Acquire Infrastructure
t1584T1584 Compromise Infrastructure
t1585.001T1585.001 Social Media Accounts
t1589T1589 Gather Victim Identity Information
t1590T1590 Gather Victim Network Information
t1592T1592 Gather Victim Host Information
t1595T1595 Active Scanning
t1598T1598 Phishing for Information
t1599T1599 Network Boundary Bridging
t1602T1602 Data from Configuration Repository
t1614T1614 System Location Discovery
t1619T1619 Cloud Storage Object Discovery
ta0011TA0011 Command and Control

Custom

In additional to the system default categories, custom categories can also be configured in Netography Fusion. To create a custom category in the portal, go to DETECTION > Detection Categories, then on the main Detection Categories menu, select the Custom tab on the top next to the System tab, and finally click the ADD/UPDATE CATEGORY on the top right.

You can input your own category and description and hit SAVE at the bottom of the window when finished.

Layout options

On the top hamburger button next to the far left of the Category column, you can export your System category results in your current view, or all fields. You can also configure the layout options by toggling the switches for each column.

Updated 6 months ago