# Elastic/ELK to a Use Case Framework (UCF) like Magma & Mitre Framework

**URL:** <https://discuss.elastic.co/t/elastic-elk-to-a-use-case-framework-ucf-like-magma-mitre-framework/236517>\
**Category:** Elastic Security\
**Created:** [June 10, 2020, 1:21pm UTC](https://discuss.elastic.co/t/elastic-elk-to-a-use-case-framework-ucf-like-magma-mitre-framework/236517 "2020-06-10T13:21:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)\
**Post date:** [June 10, 2020, 1:21pm UTC](https://discuss.elastic.co/t/elastic-elk-to-a-use-case-framework-ucf-like-magma-mitre-framework/236517/1 "2020-06-10T13:21:47Z")

</div>

hi folks,

anyone have written/implemented logic to best make use of tagging and alerting SIEM outcomes to a use case framework. I was mostly looking for [MaGMa framework](https://www.betaalvereniging.nl/wp-content/uploads/FI-ISAC-Use-Case-Framework-Full-Documentation.pdf) which is getting popularity

Any help or implementation tips to a use-case framework would be very helpful

---

<div class="post-metadata">

**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\
**Post date:** [June 10, 2020, 4:11pm UTC](https://discuss.elastic.co/t/elastic-elk-to-a-use-case-framework-ucf-like-magma-mitre-framework/236517/2 "2020-06-10T16:11:20Z")

</div>

I am sure others can speak more about it than myself with regards to direct experience, but the alerting framework does support native tagging of Mitre Attacks when creating rules and here is a blog post about it:

> **[Generating MITRE ATT&CK® Signals in Elastic SIEM](https://www.elastic.co/blog/signals-in-elastic-siem-sysmon-data)**
>
> In this blog post, we outline a straightforward approach to detecting threats with Elastic SIEM that doesn't require any specific security, programming, or analytical knowledge — it's perfect for helping just about any security practitioner stay...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 8:01am UTC](https://discuss.elastic.co/t/elastic-elk-to-a-use-case-framework-ucf-like-magma-mitre-framework/236517/3 "2022-11-04T08:01:56Z")

</div>