Skip to content

Data quality

Jump to bottom
Marcus Bakker edited this page Mar 29, 2019 · 10 revisions

What is the quality of that data? If the quality of your data is poor, it is either hard to find what you are looking for or the data may even not be there. That is where scoring your data quality comes in. Blue ATT&CK offers a standardised scoring table to score your data's quality based on different aspects. Use the score that fits the best. In the end, when you have determined all your data source's quality, you can start improving.

Data quality dimension

Blue ATT&CK describes five different data quality dimensions: device completeness, data completeness, timeliness, consistency and retention. Scoring your data quality means scoring each of these dimensions for every data source you have. The scorings table will guide you in scoring.

The administration of your data sources can be done in YAML files and is explained in YAML administration data sources.

Excel output

You can generate an Excel sheet containing all your data sources, attributes, notes and data quality scoring:

python blue_attack.py ds -f sample-data/data-sources-endpoints.yaml -e
Blue ATT&CK - Data quality

Overview

  1. Home
  2. Introduction
  3. Installation and requirements
  4. Getting started / How to
  5. Changelog
  6. Future developments
  7. ICS - Inconsistencies

Data sources

  1. Introduction
  2. DeTT&CT data sources
  3. Data sources per platform
  4. Data quality
  5. Scoring data quality
  6. Improvement graph

Visibility Coverage

  1. Introduction
  2. Scoring visibility
  3. Improvement graph

Detection coverage

  1. Introduction
  2. Scoring detection
  3. Improvement graph

Threat actor group mapping

  1. Introduction

YAML administration files

  1. Introduction
  2. Data sources
  3. Techniques
  4. Groups
  5. DeTT&CT Editor
Clone this wiki locally