Skip to content
Sign In
Telemetry

Telemetry

Which log events an organization needs to collect, per host role and log source, and why: the ATT&CK techniques each event helps detect, the vendor rules that depend on it, the standards that name it, and what collecting it costs. Built from public sources only.

What you run

Choose what you run and the events to collect appear below: the minimum set per role, then what is recommended, with the rules your SIEM can run on each, the standards that name it, and what your EDR does and does not replace. Your answers travel in the page's address and nowhere else, so the link can be shared or printed.

Compliance, optional

Three short steps about where the organization operates and what it holds. They add an Obligations panel under the results; the link in your address bar carries these choices and nothing else.

1. Where and what: jurisdiction
1. Where and what: sector

M-26-14 covers federal agency information systems, including those run for an agency by third parties. It does not apply to national security systems (44 U.S.C. 3553(d)), and for certain Defense and intelligence-community systems the oversight it rests on is delegated to the Secretary of Defense and the Director of National Intelligence (3553(e)).

2. Data and roles: what the environment holds
3. Does any system in this environment administer access to the data or systems you ticked?
Environment
Clouds and tenants
Windows
Linux
Other hosts
Identity provider
EDR
SIEM or rule base
Compliance driver
The link in your address bar holds these answers and nothing else.

Choose at least one kind of host, tenant or sensor above, and the events to collect appear here.

Roles

A role is a kind of host or tenant. Each role page lists the events that meet the minimum bar for it and the events recommended beyond that, with how to enable each one.

Azure (platform and Entra ID)

Google Cloud (and Google Workspace)

Container runtimes (Docker, containerd)

VMware ESXi / vCenter

Oracle Cloud Infrastructure

Network devices and network sensors

Identity providers and SaaS (Okta, GitHub, Slack, ...)

Log sources

98 log sources across 15 host types. A source page shows its licensing, the techniques and rules that depend on it, and every event it carries.

VMware ESXi / vCenter

How it is built

The method page states the criteria and thresholds, all fixed before any count was made. The references page names every source with its version, the date it was read and its license.

Dataset version 0.5.3, built 2026-11-08, from public sources only. Vendor rule names, requirement text and ATT&CK content are reproduced as published; the links between them are the authors' analysis. See the references for each source, its version and its license.