Observation Types

Observation Types

Observation Types define the categories of security telemetry you expect to see from your assets.

What is an Observation Type?

An observation type represents a specific kind of security data:

• Process execution events
• Network connections
• File modifications
• Authentication attempts
• DNS queries

Built-in Observation Types

SilentPulse includes common observation types:

Type	Description	Typical Source
edr.process	Process creation/termination	CrowdStrike, Defender
edr.network	Network connections	CrowdStrike, Defender
edr.file	File operations	CrowdStrike, Defender
fw.traffic	Firewall logs	Palo Alto, Fortinet
auth.login	Authentication events	AD, Okta, Azure AD
dns.query	DNS resolution	DNS servers, EDR

Custom Observation Types

Create custom types for your specific telemetry:

name: custom.app_logs
description: Application security logs
identifier_field: hostname
timestamp_field: "@timestamp"
query_template: |
  index=app_logs sourcetype=security
  | stats latest(_time) by hostname

Observation Thresholds

Each observation type has configurable thresholds:

• Warning: Time before a warning alert (e.g., 1 hour)
• Critical: Time before a critical alert (e.g., 4 hours)
• Expected Interval: Normal reporting frequency

Mapping to MITRE ATT&CK

Observation types can be mapped to MITRE ATT&CK data sources, enabling impact analysis when visibility is lost:

name: edr.process
mitre_data_sources:
  - Process Creation
  - Command Execution

When this observation type goes silent, SilentPulse shows which techniques lose detection coverage.