What's New
Updates
Section titled “Updates”July 2026
Section titled “July 2026”2026-07-05
Section titled “2026-07-05”- Migrated all event mappings to MITRE ATT&CK v19 (released April 2026).
- The Defense Evasion tactic was split by MITRE into Stealth (TA0005) and Defense Impairment (TA0112). All 96 events previously mapped to Defense Evasion have been re-mapped: 94 to Defense Impairment, 1 to Stealth, and 1 to both.
- The 15 events mapped to T1078.004 (Cloud Accounts) — AssumeRole, ConsoleLogin, token-generation, and role-assumption events — gained the Stealth tactic, matching the technique’s v19 tactic set.
- Technique references updated for MITRE’s restructuring of Impair Defenses (T1562), which was revoked in v19: T1562 and T1562.001 are now T1685 (Disable or Modify Tools), T1562.008 is now T1685.002 (Disable or Modify Cloud Log), and T1562.007 is now T1686.001 (Cloud Firewall, under the new T1686 Disable or Modify System Firewall).
- Several events were moved to more specific sub-techniques as part of the migration, including flow log and diagnostic settings deletions (T1685.002) and network security group deletion (T1686.001).
- Technique and tactic reference data across the site now resolves from the ATT&CK v19.1 dataset.
- A full mapping audit of all 261 events against v19 corrected 13 events: removed redundant parent techniques where a sub-technique was present, and added missing tactics/techniques (T1484.002, T1537, T1550.001, T1021.004) where an event’s tactic had no supporting technique.
June 2026
Section titled “June 2026”2026-06-01
Section titled “2026-06-01”- Initial launch of TheCloud.Events with 261 cloud security events across AWS (143), Azure (79), and GCP (39).
- Every event is mapped to MITRE ATT&CK tactics and techniques.
- Each event includes a sample log entry showing the activity as it appears in CloudTrail, Azure Activity / Entra audit logs, or GCP Cloud Audit Logs.
- MITRE Map view for browsing events by tactic and cloud provider.
- Filterable events page with CSP and tactic filters.
TheCloud.Events references the MITRE ATT&CK® framework. © The MITRE Corporation. ATT&CK® and ATT&CK Matrix™ are trademarks of The MITRE Corporation. ATT&CK content is reproduced and distributed under MITRE’s Terms of Use.