Count Detection Events by Tactics

Visualize MITRE ATT&CK tactics distribution

This is a query example for the Tactics widget in the Summary Dashboard dashboard of the crowdstrike/siem-connector package.

Query

flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2[/Filter/] 3{{Aggregate}} result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> result

logscale

metadata.eventType = DetectionSummaryEvent
| event.ComputerName=* AND metadata.customerIDString = *
| top(event.Tactic)

Introduction

This widget is used to display the distribution of detection events across different MITRE ATT&CK tactics, visualized as a pie chart.

In this widget, the top() function is used to aggregate and count events by their associated MITRE ATT&CK tactics.

Example incoming data might look like this:

@timestamp	#error	#humioBackfill	#repo	#type	@error	@error_msg	@error_msg[0]	@id	@ingesttimestamp	@rawstring	@timezone	affected_hosts[0].detection_count	affected_hosts[0].first_seen	affected_hosts[0].hostname	affected_hosts[0].ip_address	affected_hosts[0].last_seen	affected_hosts[0].sensor_id	affected_hosts[1].detection_count	affected_hosts[1].first_seen	affected_hosts[1].hostname	affected_hosts[1].ip_address	affected_hosts[1].last_seen	affected_hosts[1].sensor_id	affected_hosts[2].detection_count	affected_hosts[2].first_seen	affected_hosts[2].hostname	affected_hosts[2].ip_address	affected_hosts[2].last_seen	affected_hosts[2].sensor_id	context.falcon_intel_reports[0]	context.falcon_intel_reports[1]	context.mitre_attack_url	context.risk_score	event.AgentIdString	event.Attributes.execution_id	event.Attributes.report_metadata.subtype	event.Attributes.scheduled_report_id	event.AuditKeyValues[0].Key	event.AuditKeyValues[0].Value	event.AuditKeyValues[0].ValueString	event.AuditKeyValues[1].Key	event.AuditKeyValues[1].Value	event.AuditKeyValues[1].ValueString	event.AuditKeyValues[2].Key	event.AuditKeyValues[2].Value	event.AuditKeyValues[2].ValueString	event.ComputerName	event.CustomerIdString	event.EventType	event.EventUUID	event.ExternalAPIType	event.Nonce	event.OperationName	event.ServiceName	event.UTCTimestamp	event.UserId	event.UserIp	event.cid	event.eid	event.timestamp	metadata.aid	metadata.aip	metadata.cid	metadata.customerIDString	metadata.eventCreationTime	metadata.eventPlatform	metadata.eventType	metadata.event_id	metadata.id	metadata.name	metadata.offset	metadata.severity	metadata.version	potential_actors[0].actor_name	potential_actors[0].confidence	potential_actors[0].evidence	recommendations[0]	recommendations[1]	recommendations[2]	recommendations[3]	related_detections[0]	related_detections[1]	related_detections[2]	summary.affected_hosts_count	summary.confidence	summary.detection_count	summary.first_detection_time	summary.last_detection_time	summary.severity	summary.title	techniques[0].description	techniques[0].objective	techniques[0].tactic	techniques[0].technique_id	techniques[0].technique_name	techniques[1].description	techniques[1].objective	techniques[1].tactic	techniques[1].technique_id	techniques[1].technique_name	techniques[2].description	techniques[2].objective	techniques[2].tactic	techniques[2].technique_id	techniques[2].technique_name
2026-01-20T08:44:43	true	0	auto-dashboard-queries	siem-connector	true	timestamp was not set to a value after 1971. Setting it to now	timestamp was not set to a value after 1971. Setting it to now	sd6u8WImB06fMtTL7gzFlqYX_2_13_1768898683	2026-01-20T08:44:43	{"metadata":{"eventType":"UserActivityAuditEvent","eventCreationTime":1710340124,"offset":341.111,"customerIDString":"a1b2c3d4e5f6g7h8i9j0","version":"1.0"},"event":{"UserId":"adamsb","UserIp":"192.168.2.143","OperationName":"delete_report_execution","ServiceName":"scheduled_reports","AuditKeyValues":[{"Key":"scheduled_report_id","ValueString":"123456781234567812345678"},{"Key":"execution_id","ValueString":"123456781234567812345678"},{"Key":"report_metadata.subtype","ValueString":"detection_summary"}],"UTCTimestamp":1710343724,"Attributes":{"execution_id":"234567892345678923456789","report_metadata.subtype":"host_inventory","scheduled_report_id":"234567892345678923456789"},"CustomerIdString":"b2c3d4e5f6g7h8i9j0k1","Nonce":1,"AgentIdString":"12345678123456781234567812345678","EventUUID":"12345678-1234-5678-1234-123456781234","cid":"c3d4e5f6g7h8i9j0k1l2","eid":118,"timestamp":"2025-03-13:15:48:44 +0000","EventType":"Event_ExternalApiEvent","ExternalAPIType":"Event_UserActivityAuditEvent"}} c8976e33e73b8bffbf1cefbb7e6f8403	Z																							12345678123456781234567812345678	234567892345678923456789	host_inventory	234567892345678923456789	scheduled_report_id		123456781234567812345678	execution_id		123456781234567812345678	report_metadata.subtype		detection_summary		b2c3d4e5f6g7h8i9j0k1	Event_ExternalApiEvent	12345678-1234-5678-1234-123456781234	Event_UserActivityAuditEvent	1	delete_report_execution	scheduled_reports	1710343724	adamsb	192.168.2.143	c3d4e5f6g7h8i9j0k1l2	118	2025-03-13:15:48:44 +0000				a1b2c3d4e5f6g7h8i9j0	1710340124		UserActivityAuditEvent				341.111		1.0
2026-01-20T08:44:43			auto-dashboard-queries	siem-connector				QTsJCoPniAANCCdKBxWdooCq_14_282_1768898683	2026-01-20T08:44:44	{ "metadata" : { "eventType": "ReconNotificationSummary", "eventCreationTime": "1768898683967", "event_id": "rns-f47ac10b-58cc-4372-a567-0e02b2c3d479", "customerIDString": "d4e5f6g7h8i9j0k1l2m3" }, "summary": { "title": "Reconnaissance Activity Detected", "severity": "4", "confidence": "3", "detection_count": 3, "first_detection_time": "2026-01-08T14:27:31.456Z", "last_detection_time": "2026-01-08T15:30:12.789Z", "affected_hosts_count": 3 }, "techniques": [ { "technique_id": "T1059.001", "technique_name": "PowerShell", "tactic": "Discovery", "objective": "Internal Reconnaissance", "description": "Detected suspicious PowerShell command execution with encoded arguments" }, { "technique_id": "T1003.001", "technique_name": "LSASS Memory", "tactic": "Discovery", "objective": "Internal Reconnaissance", "description": "Detected potential credential dumping from LSASS memory" }, { "technique_id": "T1021.002", "technique_name": "SMB/Windows Admin Shares", "tactic": "Discovery", "objective": "Internal Reconnaissance", "description": "Detected suspicious access to administrative shares" } ], "affected_hosts": [ { "hostname": "PROD-WEB01", "ip_address": "192.168.0.87", "sensor_id": "e5f6g7h8i9j0k1l2m3n4", "first_seen": "2026-01-15T13:25:32.000Z", "last_seen": "2026-01-17T17:43:20.000Z", "detection_count": 7 }, { "hostname": "PROD-APP02", "ip_address": "192.168.3.211", "sensor_id": "f6g7h8i9j0k1l2m3n4o5", "first_seen": "2026-01-20T06:13:09.000Z", "last_seen": "2026-01-25T02:00:54.000Z", "detection_count": 1 }, { "hostname": "PROD-DB01", "ip_address": "192.168.1.54", "sensor_id": "g7h8i9j0k1l2m3n4o5p6", "first_seen": "2026-01-14T13:04:37.000Z", "last_seen": "2026-01-16T13:59:20.000Z", "detection_count": 4 } ], "potential_actors": [ { "actor_name": "APT29", "confidence": "2", "evidence": "Command and control infrastructure matches known APT29 domains" } ], "recommendations": [ "Isolate affected hosts from the network", "Review authentication logs for suspicious access attempts", "Enable multi-factor authentication for all privileged accounts", "Update antivirus signatures and perform a full system scan" ], "related_detections": [ "det-6ba7b810-9dad-11d1-80b4-00c04fd430c8", "det-3d6f4e2a-8b9c-4f1e-a2d5-7c8e9f0a1b2c", "det-9e8d7c6b-5a4f-4e3d-2c1b-0a9f8e7d6c5b" ], "context": { "risk_score": 87, "mitre_attack_url": "https://attack.mitre.org/techniques/T1078.002/", "falcon_intel_reports": [ "INTEL-T_SHORT_MD5_T", "INTEL-T_SHORT_MD5_T" ] } } c8976e33e73b8bffbf1cefbb7e6f8403	Z	7	2026-01-15T13:25:32.000Z	PROD-WEB01	192.168.0.87	2026-01-17T17:43:20.000Z	e5f6g7h8i9j0k1l2m3n4	1	2026-01-20T06:13:09.000Z	PROD-APP02	192.168.3.211	2026-01-25T02:00:54.000Z	f6g7h8i9j0k1l2m3n4o5	4	2026-01-14T13:04:37.000Z	PROD-DB01	192.168.1.54	2026-01-16T13:59:20.000Z	g7h8i9j0k1l2m3n4o5p6	INTEL-T_SHORT_MD5_T	INTEL-T_SHORT_MD5_T	https://attack.mitre.org/techniques/T1078.002/	87																															d4e5f6g7h8i9j0k1l2m3	1768898683967		ReconNotificationSummary	rns-f47ac10b-58cc-4372-a567-0e02b2c3d479						APT29	2	Command and control infrastructure matches known APT29 domains	Isolate affected hosts from the network	Review authentication logs for suspicious access attempts	Enable multi-factor authentication for all privileged accounts	Update antivirus signatures and perform a full system scan	det-6ba7b810-9dad-11d1-80b4-00c04fd430c8	det-3d6f4e2a-8b9c-4f1e-a2d5-7c8e9f0a1b2c	det-9e8d7c6b-5a4f-4e3d-2c1b-0a9f8e7d6c5b	3	3	3	2026-01-08T14:27:31.456Z	2026-01-08T15:30:12.789Z	4	Reconnaissance Activity Detected	Detected suspicious PowerShell command execution with encoded arguments	Internal Reconnaissance	Discovery	T1059.001	PowerShell	Detected potential credential dumping from LSASS memory	Internal Reconnaissance	Discovery	T1003.001	LSASS Memory	Detected suspicious access to administrative shares	Internal Reconnaissance	Discovery	T1021.002	SMB/Windows Admin Shares
2026-01-20T08:44:44			auto-dashboard-queries	siem-connector				QTsJCoPniAANCCdKBxWdooCq_14_283_1768898684	2026-01-20T08:44:45	{ "metadata":{ "eventCreationTime":"1768898684540", "eventPlatform": "Identity", "eventType": "IdentityProtectionEvent", "name": "IdentityProtectionEvent", "severity": "9", "aid": "h8i9j0k1l2m3n4o5p6q7", "aip": "192.168.4.198", "cid": "i9j0k1l2m3n4o5p6q7r8", "id": "AUD-T_SHORT_MD5_T" } } c8976e33e73b8bffbf1cefbb7e6f8403	Z																																																		h8i9j0k1l2m3n4o5p6q7	192.168.4.198	i9j0k1l2m3n4o5p6q7r8		1768898684540	Identity	IdentityProtectionEvent		AUD-T_SHORT_MD5_T	IdentityProtectionEvent		9
2026-01-20T08:44:45			auto-dashboard-queries	siem-connector				QTsJCoPniAANCCdKBxWdooCq_14_284_1768898685	2026-01-20T08:44:46	{"metadata":{ "eventType":"UserActivityAuditEvent","eventCreationTime":"1768898685309","customerIDString":"j0k1l2m3n4o5p6q7r8s9" }, "event":{"UserId":"andersonk","ComputerName":"PROD-FILE01","ServiceName":"CrowdStrike Authentication", "AuditKeyValues":[{"Key":"AUD-7f92e3b1","Value":"Modified rule FW-3782 in policy 'Corporate Perimeter Defense'"},{"Key":"AUD-c45d8a6e","Value":"Added exception for host 192.168.45.12 to policy 'Data Center Access'"},{"Key":"AUD-21b9f037","Value":"Deleted user account 'mwilliams' from Active Directory group 'Finance-Users'"}]}} c8976e33e73b8bffbf1cefbb7e6f8403	Z																											AUD-7f92e3b1	Modified rule FW-3782 in policy 'Corporate Perimeter Defense'		AUD-c45d8a6e	Added exception for host 192.168.45.12 to policy 'Data Center Access'		AUD-21b9f037	Deleted user account 'mwilliams' from Active Directory group 'Finance-Users'		PROD-FILE01							CrowdStrike Authentication		andersonk								j0k1l2m3n4o5p6q7r8s9	1768898685309		UserActivityAuditEvent
2026-01-20T08:44:46			auto-dashboard-queries	siem-connector				QTsJCoPniAANCCdKBxWdooCq_14_285_1768898686	2026-01-20T08:44:46	{"metadata":{ "eventType":"UserActivityAuditEvent","eventCreationTime":"1768898686099","customerIDString":"k1l2m3n4o5p6q7r8s9t0" }, "event":{"UserId":"bakerm","ComputerName":"PROD-SQL01","OperationName":"create_policy", "AuditKeyValues":[{"Key":"AUD-9e3d5c8a","Value":"Changed password expiration policy from 60 to 45 days"},{"Key":"AUD-56f1a7d2","Value":"Exported configuration backup of firewall cluster 'edge-fw-01'"}]}} c8976e33e73b8bffbf1cefbb7e6f8403	Z																											AUD-9e3d5c8a	Changed password expiration policy from 60 to 45 days		AUD-56f1a7d2	Exported configuration backup of firewall cluster 'edge-fw-01'					PROD-SQL01						create_policy			bakerm								k1l2m3n4o5p6q7r8s9t0	1768898686099		UserActivityAuditEvent

Step-by-Step

Starting with the source repository events.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2[/Filter/] 3{{Aggregate}} result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
metadata.eventType = DetectionSummaryEvent
```
Filters events to include only those where metadata.eventType equals DetectionSummaryEvent.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2[/Filter/] 3{{Aggregate}} result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> result style 2 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
| event.ComputerName=* AND metadata.customerIDString = *
```
Ensures both event.ComputerName and metadata.customerIDString fields exist in the events.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2[/Filter/] 3{{Aggregate}} result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> result style 3 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
| top(event.Tactic)
```
Aggregates events by the event.Tactic field and counts their occurrences. The top() function automatically sorts the results by count in descending order.
Event Result set.

Summary and Results

The widget is used to provide visibility into the most common MITRE ATT&CK tactics observed in detection events.

This widget is useful to identify prevalent attack patterns and prioritize security controls based on the most frequently observed tactics.

Sample output from the incoming example data:

_count	event.Tactic
3	Execution
3	Credential Access
2	Defense Evasion
2	Lateral Movement
2	Persistence

The results are displayed in a pie chart where each slice represents a MITRE ATT&CK tactic, and the size of each slice corresponds to the number of events associated with that tactic.

Versions of this Page

Examples Library