Detection telemetry and configuration
These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.
Application Log Content · source-mapped
DC0038 collection page — Select the application event family required by the detection and document its native schema before normalization.
Providers and collection configuration
- Enable the application audit category or instrument the owned lab application at the authorization/action boundary.
- Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.
- Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart.
Required normalized fields: service, action, actor, record_count, result.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0038",
"collector": "illustrative-lab-collector",
"observation": {
"service": "lab-portal",
"action": "export_requested",
"actor": "lab-reader",
"record_count": 3,
"result": "authorized"
}
}
Visibility limits: Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.
Cloud Service Disable · source-mapped
DC0090 collection page — Collect service disable/stop-logging administrative actions and independent health/configuration checks; monitor the audit destination itself.
Providers and collection configuration
- In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.
- Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.
- Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies.
Required normalized fields: resource_id, action, enabled_before, enabled_after.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0090",
"collector": "illustrative-lab-collector",
"observation": {
"resource_id": "lab-service-1",
"action": "disable",
"enabled_before": true,
"enabled_after": false
}
}
Visibility limits: AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.
Command Execution · source-mapped
DC0064 collection page — Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.
Providers and collection configuration
- Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.
- Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.
- On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records.
Required normalized fields: interpreter, command_line, actor_uid, session_id.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0064",
"collector": "illustrative-lab-collector",
"observation": {
"interpreter": "/bin/sh",
"command_line": "printf LAB_TELEMETRY_CHECK",
"actor_uid": 1000,
"session_id": "lab-session-1"
}
}
Visibility limits: Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.
Driver Load · source-mapped
DC0079 collection page — Collect Sysmon DriverLoad (6) and retain image path, hash and signature result; distinguish load from file installation.
Providers and collection configuration
- Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
- Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
- Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.
- On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
- Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
- For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.
Required normalized fields: driver_path, action, signature_status.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0079",
"collector": "illustrative-lab-collector",
"observation": {
"driver_path": "C:\\Lab\\demo.sys",
"action": "load",
"signature_status": "lab_fixture_only"
}
}
Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
Driver Metadata · source-mapped
DC0074 collection page — Collect signed-driver inventory with hash algorithm and signer verification result; differentiate installed files from loaded drivers.
Providers and collection configuration
- osquery: Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.
- Linux Audit plus inventory snapshots: Events explain changes; snapshots describe state at collection time.
- Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.
- Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.
- Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset.
Required normalized fields: driver_path, version, signed, loaded.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0074",
"collector": "illustrative-lab-collector",
"observation": {
"driver_path": "C:\\Lab\\demo.sys",
"version": "1.0-lab",
"signed": false,
"loaded": false
}
}
Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.
Firewall Rule Modification · source-mapped
DC0051 collection page — Collect firewall policy audit plus before/after rule snapshots; identify local versus centrally managed policy and the responsible administrator.
Providers and collection configuration
- Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.
- For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.
- Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*.
Required normalized fields: rule_id, attribute, before, after.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0051",
"collector": "illustrative-lab-collector",
"observation": {
"rule_id": "lab-rule-1",
"attribute": "remote_address",
"before": "192.0.2.10",
"after": "192.0.2.11"
}
}
Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.
Instance Modification · source-mapped
DC0073 collection page — Collect compute update/modify APIs and before/after state, including attached role, network interfaces and launch parameters where exposed.
Providers and collection configuration
- In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.
- Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.
- Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies.
Required normalized fields: instance_id, attribute, before, after.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0073",
"collector": "illustrative-lab-collector",
"observation": {
"instance_id": "vm-lab-1",
"attribute": "instance_type",
"before": "small-lab",
"after": "medium-lab"
}
}
Visibility limits: AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.
Network Traffic Content · source-mapped
DC0085 collection page — Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.
Providers and collection configuration
- Zeek: Connection and protocol metadata from traffic visible to the sensor.
- Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.
- Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
- Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
- Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.
Required normalized fields: flow_id, protocol, method, path, payload_excerpt.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0085",
"collector": "illustrative-lab-collector",
"observation": {
"flow_id": "lab-flow-1",
"protocol": "http",
"method": "GET",
"path": "/lab-check",
"payload_excerpt": "LAB_TELEMETRY_CHECK"
}
}
Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.
Process Creation · source-mapped
DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.
Providers and collection configuration
- Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
- Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
- Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.
- On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
- Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
- For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.
Required normalized fields: process_guid, image, parent_image, command_line, user.
<EventFiltering>
<ProcessCreate onmatch="include">
<Image condition="is">C:\Windows\System32\whoami.exe</Image>
</ProcessCreate>
</EventFiltering>
This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0032",
"collector": "illustrative-lab-collector",
"observation": {
"process_guid": "lab-process-001",
"image": "C:\\Windows\\System32\\whoami.exe",
"parent_image": "C:\\Windows\\System32\\cmd.exe",
"command_line": "whoami",
"user": "LAB\\analyst"
}
}
Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
Process Metadata · source-mapped
DC0034 collection page — Collect read-only process inventory with PID plus start time/stable identity, command line and collection time; restrict access to potentially sensitive arguments.
Providers and collection configuration
- osquery: Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.
- Linux Audit plus inventory snapshots: Events explain changes; snapshots describe state at collection time.
- Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.
- Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.
- Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset.
Required normalized fields: process_id, image, owner_uid, started_at.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0034",
"collector": "illustrative-lab-collector",
"observation": {
"process_id": 4200,
"image": "/usr/bin/sleep",
"owner_uid": 1000,
"started_at": "2026-09-27T11:59:00Z"
}
}
Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.
Service Metadata · source-mapped
DC0041 collection page — Inventory service name, executable, startup mode, owner and status using supported OS APIs; compare successive snapshots.
Providers and collection configuration
- osquery: Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.
- Linux Audit plus inventory snapshots: Events explain changes; snapshots describe state at collection time.
- Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.
- Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.
- Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset.
Required normalized fields: service, executable, start_mode, state.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0041",
"collector": "illustrative-lab-collector",
"observation": {
"service": "LabService",
"executable": "C:\\Lab\\service.exe",
"start_mode": "manual",
"state": "stopped"
}
}
Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.