Events
The individual technical actions that can be included in scenarios
The table lists, for every available event: its type (
network, windows, linux, macos), default severity (red = high, yellow = low — see Scores & statuses ), name, whether a detection rule is available (Sigma, Suricata), and its MITRE ATT&CK tactic and technique ID.Click an event's name to see all its information, including its description. The MITRE technique reference links to that technique's page on the MITRE ATT&CK website.
To work through the list, you can sort by name (A→Z, Z→A), filter (default severity, environment, MITRE ATT&CK tactic, availability of a Sigma rule), search, and switch between the table and the MITRE ATT&CK matrix view.
Event types
An event's type indicates the layer it runs at and shapes the kind of action it performs:
- Network — executed at the network layer. Typical actions: port scans, brute-force attempts, enumeration of services listening on the network, attempted communications for data exfiltration.
- Windows — executed on the Windows OS. Typical actions: system reconnaissance, configuration changes, privilege escalation, password extraction, defense evasion, vulnerability exploitation (CVE), binary deployment.
- Linux — executed on the Linux OS. The same families of actions as Windows, adapted to the operating system.
- macOS — executed on the macOS OS. The same families of actions, adapted to the operating system.